Methods and systems for trusted unknown malware detection and classification in linux cloud environments

A method for detection of unknown malware in Linux cloud environment, the method comprising:

• within a hypervisor, acquiring a raw data set comprising one or more volatile memory dumps of a Linux cloud server, wherein the volatile memory dumps are associated with a current state of the virtual machine's volatile memory;
• extracting one or more features from the raw data set (either by utilizing knowledge based features or by utilizing Deep Learning CNN architectures);
• and
• classifying, using at least one classifier, the one or more features, to determine if one or more of the features are associated with a malware, thereby detecting malware in a Linux cloud environment and distinguishing between a benign or malicious state of the server.

A method for detection of malware in Linux cloud environments, comprising:

• within a hypervisor, acquiring data from volatile memory dumps of a Linux cloud server;
• (pre)processing at least a portion of the data, thereby generating a processed data set;
• extracting one or more features from the processed data set;
• and
• classifying, the one or more features to determine if one or more of the features are associated with a malware, thereby detecting malware in a Linux.