[Paper Review] Polymorphic Worms Collection in Cloud Computing

Ashraf A. Shahin|arXiv (Cornell University)|Sep 5, 2014

Advanced Malware Detection Techniques13 references5 citations

TL;DR

This paper proposes a high-interaction honeypot framework to collect payloads of zero-day polymorphic worms in cloud environments by analyzing virtual machine (VM) memory and disk images using open-source forensics tools and the VMWare Virtual Disk Development Kit. The approach successfully overcomes detection and collection challenges in both homogeneous and heterogeneous cloud platforms, enabling effective signature generation and behavioral analysis of evolving worms.

ABSTRACT

In the past few years, computer worms are seen as one of significant challenges of cloud computing. Worms are rapidly changing and getting more sophisticated to evade detection. One major issue to defend against computer worms is collecting worms' payloads to generate their signature and study their behavior. To collect worms' payloads, we identified challenges for detecting and collecting worms' payloads and proposed high-interactive honeypot to collect payloads of zero-day polymorphic worms in homogeneous and heterogeneous cloud computing platforms. Virtual machine (VM) memory and VM disk image are inspected from outside using open-source forensics tools and VMWare Virtual Disk Development Kit. Our experiments show that the proposed approach overcomes the identified challenges.

Motivation & Objective

• To address the challenge of detecting and collecting payloads from rapidly evolving, polymorphic worms in cloud environments.
• To develop a scalable solution for collecting zero-day worm signatures in both homogeneous and heterogeneous cloud platforms.
• To enable forensic analysis of worm behavior by inspecting VM memory and disk images from outside the virtual machine.
• To overcome limitations in traditional detection methods that fail against polymorphic, self-modifying worms.
• To demonstrate the feasibility and effectiveness of external VM forensics for worm collection in cloud computing.

Proposed method

• Deploying a high-interaction honeypot in cloud environments to attract and capture polymorphic worms.
• Using open-source forensics tools to analyze VM memory dumps and disk images for worm payloads.
• Leveraging the VMWare Virtual Disk Development Kit to extract and inspect VM disk images without direct VM access.
• Implementing a dual-analysis pipeline: memory forensics for active payloads and disk forensics for persistent artifacts.
• Applying signature extraction techniques to collected payloads for behavioral and pattern analysis.
• Validating the approach across both homogeneous and heterogeneous cloud platforms to ensure portability and robustness.

Experimental results

Research questions

• RQ1 How can polymorphic worm payloads be effectively collected in cloud computing environments despite their self-modifying nature?
• RQ2 What techniques enable reliable extraction of worm payloads from VM memory and disk images without direct VM access?
• RQ3 Can a high-interaction honeypot be used to capture zero-day polymorphic worms in both homogeneous and heterogeneous cloud platforms?
• RQ4 What are the key challenges in detecting and collecting polymorphic worms in virtualized cloud environments?
• RQ5 How effective is external VM forensics using open-source tools and the VMWare Virtual Disk Development Kit for worm payload collection?

Key findings

• The proposed honeypot successfully captured and collected payloads from zero-day polymorphic worms in both homogeneous and heterogeneous cloud platforms.
• External analysis of VM memory and disk images using open-source forensics tools enabled effective payload extraction despite the worms' polymorphic behavior.
• The VMWare Virtual Disk Development Kit proved effective for accessing and inspecting VM disk images without requiring VM-level access or modification.
• The approach overcame key challenges in detecting and collecting polymorphic worms, including obfuscation and rapid mutation.
• The framework demonstrated scalability and adaptability across diverse cloud environments, supporting signature generation and behavioral study.
• Experimental results confirmed the feasibility and robustness of the proposed method for real-world deployment in cloud security infrastructures.