# Cloud Security Using Fine-Grained Efficient Information Flow Tracking
## 5 Data Leak Prevention Using CloudMonitor
### Using CloudMonitor to Detect Remote Computer Worm Attacks
#### 5.4.1 Consumer-Side Attack Analysis  
CloudMonitor was used to study a computer worm assault from the consumer's perspective. During the experiment, a virtual computer network comprised of many virtual machines, including user virtual machines and OwnCloud acting as the cloud storage server configured with VirtualBox was utilized. To mimic the attack, the start and termination scripts have been set up on the OwnCloud server so that the Netlink-based logger will be initiated just before the attack's execution. Within the execution of the assault on the user's virtual machines, a Netlink-based logging application tracks all processes initiated during the period of the attack, encompassing both attack-related actions and background activities. After the attack is complete, a signal is sent to the consumer side by the start and termination script to end the Netlink-based logger on the virtual PC of the victim. The Netlink-based logger then completes the process of logging 30 s after receiving the termination signal. As a result of the attack, after the logging process is finished, a log file named \"log.txt\" will be stored in the /Desktop/logger directory, along with a screenshot file placed on the user's desktop. The log file is then sent to a visualization tool to analyze the various processes and their associations utilizing a process trace graph.  
This consumer-side visualization tool is comprised of several processes. During the execution of a computer worm attack, for instance, the SCP process acts as the entry process of the entire attack scenario, in which the attacker injects the necessary files and scripts as a zip payload to the target machine in the network. The SCP process originates from a background process operating within the Linux environment (host machine), ultimately evolving into the parent process. When the attacker initiates a SCP communication protocol with the user machines, a SCP process is created. This process navigates to the /tmp directory, the location used to deposit the \"screenagh.zip\" payload, which then is used by SSH processes created during the attack time frame to execute the attack.  
During the execution of the attack, SSH processes are generated, with each SSH process spawning three offspring processes. Each SSH parent process spawns a child process that modifies its directory to /tmp, the directory from where the payload was initially injected onto the consumer machine. The second process, which originated directly from the SSH parent process, unzips the payload and subsequently initiates another process to perform an update of the Linux package repository using \"sudo aptget update.\" which will eventually spawn additional child processes to update all existing Linux packages installed on the host system. After all packages have been updated successfully by the parent and child processes, the SSH processes spawn further children processes to run \"sudo apt-get install libx11-dev\" and \"sudo apt-get install libpng-dev\" (for capturing screenshots and saving them in \".png\" format on the Linux file system respectively, typically need packages).  
Attack processes launched during attack execution can be traced back to one of SSH's parent processes. Some of the tasks undertaken by these processes include updating repository packages, installing dependencies required to execute the attack, compiling the computer worm source code to fit into the consumer network, etc. Numerous variables, including the operating system, kernel version, and compiler version, affect the number of attack-related processes created.  
The computer worm attack process is responsible for running the attack binary on the user's system when the attack process created from the attacker's SSH session completes the compilation of the computer worm source code. Since the source code of the attack was developed from a single-process, single-threaded execution in mind, only one attack is made during the attack's execution, allowing the attacker to run this attack on other machines.