论文标题
西班牙海鲜饭:基于边缘的实时恶意软件检测数据中心
pAElla: Edge-AI based Real-Time Malware Detection in Data Centers
论文作者
论文摘要
如今,越来越多的用途(IoT)设备用于监视广泛的应用程序,以及他们经常需要进行数据分析所需的“大数据”流支持的挑战,如今正在推动对新兴边缘计算范式的关注。特别是,直接在网络边缘管理和分析数据的智能方法越来越多地研究,人工智能(AI)驱动的边缘计算被设想为有希望的方向。在本文中,我们专注于数据中心(DC)和超级计算机(SC),新一代的高分辨率监测系统正在部署,为诸如异常检测和安全性等分析提供了新的机会,但引入了处理大量数据的新挑战。详细介绍,我们报告了一种新颖的轻巧和可扩展的方法,以提高DCS/SC的安全性,该方法涉及高分辨率功耗的AI驱动边缘计算。该方法(称为西班牙海鲜饭)靶向实时恶意软件检测(MD),它在用于DCS/SC的基于带外IoT的监视系统上运行,并且涉及功率测量的功率频谱密度以及自动编码器。结果很有希望,F1得分接近1,错误的警报和恶意软件率接近0%。我们将我们的方法与最先进的MD技术进行了比较,并表明,在DCS/SCS的背景下,海鲜饭可以涵盖更广泛的恶意软件,在准确性方面大大优于SOA方法。此外,我们提出了一种适用于生产中DCS/SC的在线培训的方法,并发布开放数据集和代码。
The increasing use of Internet-of-Things (IoT) devices for monitoring a wide spectrum of applications, along with the challenges of "big data" streaming support they often require for data analysis, is nowadays pushing for an increased attention to the emerging edge computing paradigm. In particular, smart approaches to manage and analyze data directly on the network edge, are more and more investigated, and Artificial Intelligence (AI) powered edge computing is envisaged to be a promising direction. In this paper, we focus on Data Centers (DCs) and Supercomputers (SCs), where a new generation of high-resolution monitoring systems is being deployed, opening new opportunities for analysis like anomaly detection and security, but introducing new challenges for handling the vast amount of data it produces. In detail, we report on a novel lightweight and scalable approach to increase the security of DCs/SCs, that involves AI-powered edge computing on high-resolution power consumption. The method -- called pAElla -- targets real-time Malware Detection (MD), it runs on an out-of-band IoT-based monitoring system for DCs/SCs, and involves Power Spectral Density of power measurements, along with AutoEncoders. Results are promising, with an F1-score close to 1, and a False Alarm and Malware Miss rate close to 0%. We compare our method with State-of-the-Art MD techniques and show that, in the context of DCs/SCs, pAElla can cover a wider range of malware, significantly outperforming SoA approaches in terms of accuracy. Moreover, we propose a methodology for online training suitable for DCs/SCs in production, and release open dataset and code.