# Analyzing CNN Based Behavioural Malware Detection Techniques on Cloud IaaS

arXiv: https://arxiv.org/abs/2002.06383 · HTML: https://mlsanity.com/paper/2002.06383/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Feb 2020.

## Built on by (most cited first, 6 of 6)

- [Creating an Explainable Intrusion Detection System Using Self Organizing Maps](https://mlsanity.com/paper/2207.07465/) (2022)
- [Explainable Artificial Intelligence (XAI) for Malware Analysis: A Survey of Techniques, Applications, and Open Challenges](https://mlsanity.com/paper/2409.13723/) (2024)
- [Explainable Intrusion Detection Systems Using Competitive Learning Techniques](https://mlsanity.com/paper/2303.17387/) (2023)
- [Analyzing Machine Learning Approaches for Online Malware Detection in Cloud](https://mlsanity.com/paper/2105.09268/) (2021)
- [Using Deep Learning to Detect Digitally Encoded DNA Trigger for Trojan Malware in Bio-Cyber Attacks](https://mlsanity.com/paper/2202.11824/) (2022)
- [Deep Learning Based XIoT Malware Analysis: A Comprehensive Survey, Taxonomy, and Research Challenges](https://mlsanity.com/paper/2410.13894/) (2024)

## Abstract (arXiv)

Cloud Infrastructure as a Service (IaaS) is vulnerable to malware due to its exposure to external adversaries, making it a lucrative attack vector for malicious actors. A datacenter infected with malware can cause data loss and/or major disruptions to service for its users. This paper analyzes and compares various Convolutional Neural Networks (CNNs) for online detection of malware in cloud IaaS. The detection is performed based on behavioural data using process level performance metrics including cpu usage, memory usage, disk usage etc. We have used the state of the art DenseNets and ResNets in effectively detecting malware in online cloud system. CNN are designed to extract features from data gathered from a live malware running on a real cloud environment. Experiments are performed on OpenStack (a cloud IaaS software) testbed designed to replicate a typical 3-tier web architecture. Comparative analysis is performed for different metrics for different CNN models used in this research.