Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 260

a mainstream service oriented computing model became evident. It is well understood
that virtual compute clouds provide tremendous economies of scale for users.
We look at the work defined by Arenas et.al. [6] and others [2] [4] [8] [9] to develop
our own algorithms. We posit the use of schema mapping techniques to correlate log file
designs for the synchronized Virtual log auditing functions. Schema mapping
composition is a fundamental operation in data management and data exchange. The
mapping composition problem has been extensively studied for a number of mapping
languages most notably source to target tuple generating dependencies (s-t tgds). We
adopt these constraints as apart of our own specification semantics for a Global Virtual
Machine Attribute Policy Auditor (GVMAPA) which is currently ongoing work within
our research group. An important class of s-t tgds are local as view (LAV) tgds. This
class of mapping is prevalent in practical data integration and exchange systems. We
use these ideas to develop heterogeneous source-target Virtual Machine log maps,
given the rich and desirable structural properties that these mappings possess and we
think it can offer to such abstract domains.

3 Audit Log Graph Context Model

The authors posit a synchronized log file based audit mechanism for the cloud
environment. The following formalisms below represent the attribute parameters
required for defining these types of digital log footprints:
Definition 1: Virtual log (VL) footprint contains the attributes: We adopt the formal
definition from [7].

t t

n

c = { 1 e ,....., e )

a

e i x 1

l represents the maximum number of active log context and m represents the
maximum number of VM environments defined for any given active context. Each
context environment must be sensitive to the identified data, machine, and time
allocated to a specified context

c a ∈ C ∈ E 1 ≤ i ≤ l ≤ x ≤ m

, , ,

x x x x x x

i
x

i
x

i i

a

i i

b

i i

e

e = { t , { m ,..., m }, { d ,..., d }, { cn ,.., cn }}

1 1 1

Where

m x d x cn x

i
a

i
b

i
e

∈ M ∈ D ∈ CN 1 ≤ a ≤ 1 ≤ b ≤ 1 ≤ e ≤

, , , ∞, ∞, ∞.

M is the set of all machines, D is the set of all related data and CN is the set of all
connected nodes. M is assumed to be a collection of physical machines only a is the
maximum number of machines, b is the maximum number of data transactions and e
is the maximum number of nodes within a data center. As the number of machines
comprises virtual machines and connections may exist between machines of different
data centers, the value of e may be significantly larger than n-1, i.e. the number of
other data centers in this cloud instance The values for a and b are assumed to have no
upper limit as the number of machines and storage units for a particular cloud will