Abstract
In this new era of life, where technology covers our life from the early morning to late night, cybercrime is becoming more developed and challenging for the systems designers. The reason is reflected in the increased number of ways used by criminals. Cloud computing systems are natural goals due to their complexity and increasing popularity. The Cloud system provides an environment with a big number of Virtual Machines (VMs) that available to many users accessing this system via the Internet. This way of access makes cloud systems weaker than physical networks. In order to reduce the number of attacks and secure data storage, any malicious behaviour should be discovered and halted if possible. In this paper, we focus on discovery of malicious behaviour via determining unwanted symptoms rather than via targeting particular malicious behaviour of the system directly. The main motivation for our approach is that malicious behaviour (e.g., a new form of threat) is very often hard to specify directly, but it can be characterized by a set of undesired symptoms. The main contribution of this paper refers to several new mechanisms for monitoring Virtual Machines and further experimental work targeting efficient ways of visiting VMs in order to discover malicious symptoms.