Cloud Forensics in Virtual Machines Using Transparent Deep Learning Techniques

Abstract

There is a growing need and use of cloud-based services, because of the demand for these services,has also resulted into increasing number of cloud based crimes.The patterns of attacks on the source and its properties can be used to detect and acquire evidence data generated in a cloud.There is need to investigate and find out potential cybercrimes that are committed on the cloud. The use of traditional cloud forensics tools and the huge cloud data generated are among the challenges realised by cloud forensics investigators. Deep learning neural network models have been constructed to classify, detect and profiles the Virtual Machine (VM) activities supported by the KVM hypervisor. Four deep learning neural networks have been built that is Feed Forward Neural Network(FFNN),Convolutional Neural Networks (CNN),Recurrent Neural Networks (RNN) and Long Short-Term Neural Networks (LSTM) and these models performed well i.e. 99.74% for MLP,99.79% for CNN,99.74% for RNN and 97.21% for LSTM. MLP and RNN have performed better as per the experiment of 50 epochs. Explainable AI tools have been applied on the deep learning models which included LIME (Local Interpretable Model-Agnostic Explanations) and SHAP (Shapley Additive explanations) to explain the black box nature of the deep learning models.