SEER: practical memory virus scanning as a service

摘要: Virus Scanning-as-a-Service (VSaaS) has emerged as a popular security solution for virtual cloud environments. However, existing approaches fail to scan guest memory, which can contain an emerging class of Memory-only Malware. While several host-based memory scanners are available, they computationally less practical This paper proposes SEER architecture enabling Memory VSaaS virtualized leverages resources and technologies consolidate aggregate virus scanning activities efficiently detect malware residing in memory. Specifically, combines fast snapshotting computation deduplication provide efficient off-host scanning. We evaluate demonstrate up 87% reduction data size that must be scanned 72% savings overall time, compared naively applying file-based approaches. Furthermore, provides 50% time when using warm cache. In doing so, vendors transparently periodically machine malware.