Research on the Performance of Mining Packets of Educational Network for Malware Detection between PM and VM

With the fast development of online education, the volume of education data traffic increased dramatically. Security information is potential to be mined from it. We can use data mining with some cloud computing platform for malware detection because the data volume is huge. The online education institutions need to virtualize their data centers and build cloud infrastructure for better using resources. So they should move data centers from physical machines(PMs) to virtual machines(VMs) for implementing the virtualization. But there are some risks such as the loss of computing ability, performance decline and so on. In this paper, we do a series of experiments to test performance of data mining algorithm based on Hadoop in physical machines and virtual machines. Through these experiments, we find that the performance of data mining algorithm based on Hadoop depends on disk I/O performance of Hadoop. The disk I/O performance of Hadoop deployed in PMs is better than that in VMs. Some iterative algorithms like k-means need more disk I/O, so we don´t advise using VMs for computing. Other basic algorithms like Bayes classification need less disk I/O, so we advise computing in the VMs.