Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 270

in this research was to guarantee data consistency between the source and target
schemas as a data quality concern. We achieve this by applying transformation
mapping to our log auditor. The auditor runs a LOADER script, which happens to be
an Oracle stored procedure that reads the source schema after we had successfully
mapped it to our staging database. At the staging area, the LOADER script scans the
column values of the source and matches its attribute parameters before copying it to
the auditor's target database. However there are cases when an associatively mapped
VM instance, shows different transformation attributes from what is registered in the
auditor's logical target schema. This observation reflects changes in the source
schema composition due to adaptation at the source VM host. For example we noted
this as a concern, when data sets were mapped from a new test VMware host in the
production centre. The CPU World ID strings appeared to have had a concatenated
string length as compared to it's original attribute values on the current production
host VM. This resulted in null column value update on the target. We treat this as a
referential integrity constraint error at the target, and record such transformation
events as a new and unknown within the VM. Realistically, this may be considered an
inconclusive observation, as the attribute type is legitimate, it just had an unknown
format to our auditor's target schema. In this context these results will subject the
auditor to its own lack of integrity, due to human misunderstanding of these database
constraints or some other anomaly. Hence we have started to look at the various
intelligent adaptation and inference mechanisms to handle this log schema concern.
One approach is the use of chasing methods in our transformation, by running a parser
that periodically checks column formats and updates the auditor of any semantic
changes. Ongoing work explores this chasing technique not only as a function of our
static log monitoring auditor but also as dynamic monitoring parameter for the
synchronized virtual machine environment. We still don't have any conclusive
empirical study on these transformations, as our work is still in its preliminary stages.
We however are testing application log profiles to determine the different real issues
of these transformation formatting arguments.
5 Conclusion and Future Work
We have presented a formal theoretical approach on how we can establish virtual
machine log synchronization using transformation mapping mechanisms. We relate
from our case study deployment of our log auditor prototype how these transformation
mapping mechanisms prove critical to data quality assurance and invariably the security
within such logical domains. Our ongoing work assesses the transformation mapping
issues for both the homogenous and heterogeneous VM cloud environments.
References
1. Grandison, T., Maximillen, E.M., Thorpe, S., Alba, A.: Towards a Formal Cloud Computing
definition. In: Proceedings of IEEE Services (July)
2. Thorpe, S., Ray, I.: Global Virtual Machine Policy Auditor. CSU PhD Discussion Forum
(September 2010)