Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 261

grow or shrink as needed The location of the xth data center of the ith cloud, l x is a
latitude-longitude pair. A machine consists of at least one central processing unit
indexed by a unique CPU_ID and bandwidth.
The storage component is either a physical storage unit or a virtual storage unit.
Note that S = PS VS where PS is the set of all physical storage and VS is the set of

all virtual storage. The next connected data center contains the source node bandwidth
and the next or target node. Both source and target nodes are either a data center, a
physical machine address (i.e. MAC address and associated I.P. address) or a virtual
machine (i.e. a logical address mapped to a binding I.P address).
Due to the fact that a few of the base constructs in our model are composite data
types, we define a base function called in (Composite Object O, Sub-Element Type T)
that returns a set of the elements of type T in object O. The implicit assumption is that
all types in a composite object are unique. In our articulation of a cloud log instance,
we declare that the data centers are connected as a reminder.
Definition 2: Each VM node is stored as apart of a cloud log graph G .
Algorithm 1. CloudLogGraph (Cloud ci)
1: Create an empty graph G
2: For each data center dx in ci
3: Create a group graph node (ggn) in G for dx
4: For each machine m contained in dx
5: Build a node m in ggn dx for machine m
6: For each dx in ci
7: For each next element e contained in dx
8: Find the associated node or ggn associated to e's source
9: Find the associated node or ggn associated to e's target
10: Create a link between source and target
11: Assign bandwidth to the weight of the edge
12: return G

∪

Definition 3: The Virtual Log Data Set Graph GD is a set of labelled graphs,
GD={G1,G2, . . . ,Gn}, and |M| denotes the number of log graphs in a log graph
dataset, that is the size of the graph dataset. |E| denotes the number of edges of the log
graph dataset.
Definition 4: The size of a Virtual Log Graph(G) is the number of edges in
E(G).
Definition 5: A log sub-graph of a Virtual log graph G1 = {V, E} is a log graph G2 =
{W, F}, where W ⊆ V and F ⊆ E. A sub-graph G2 of G1 is a proper log sub-graph

of G1 if G2 G1.

Given two labelled graphs G1 = {V,E,∑ v ,∑ e , l} and G2 ={V,E,∑ v ,∑ e , l} 1 , G2
is a log sub graph of G1 iff
1.

∉

V 1

⊆ V.

V 1 ((l(u)) = (l 1 (u))) 2. ∀ u ∈

E, (l(u,v) = l 1 f(u),f(v) E 1 ) 3. ∀ u , v ∈ V , (u, v) ∈ ∈