  In the past few years, computer worms are seen as one of significant
challenges of cloud computing. Worms are rapidly changing and getting more
sophisticated to evade detection. One major issue to defend against computer
worms is collecting worms' payloads to generate their signature and study their
behavior. To collect worms' payloads, we identified challenges for detecting
and collecting worms' payloads and proposed high-interactive honeypot to
collect payloads of zero-day polymorphic worms in homogeneous and heterogeneous
cloud computing platforms. Virtual machine (VM) memory and VM disk image are
inspected from outside using open-source forensics tools and VMWare Virtual
Disk Development Kit. Our experiments show that the proposed approach overcomes
the identified challenges.
