Work

Malware Detection on Linux Using Runtime Opcode Tracing

Year: 2024

Type: conference-paper

Abstract: The fast-paced evolution of cyberattacks to digital infrastructures requires new protection mechanisms to counter-attack them. Malware attacks, a type of cyberattacks ranging from viruses and worms to ransomware and spyware, have been traditionally detected using signature-based methods. But with new versions of malware, this approach is not good enough, and new machine learning tools look promising. In this paper we evaluate five machine learning models (SVM, KNN, Naive Bayes, Decision Tree and Random Forest) to detect Linux malware on applications during its runtime by tracking their executed instructions (opcodes). We show the methodology, the initial dataset preparation, the infrastructure used to obtain the traces of executed instructions, and the evaluation of the results for the different models used. The obtained results show that Random Forest classifier gets the best results, with 90% accuracy or higher.

Source: Proceedings

DOI: 10.1109/dft63277.2024.10753555

Authors: Martí Alonso, Juan José Costa, Enric Morancho

Institution: Universitat Politècnica de Catalunya

Language: English

Topic: Advanced Malware Detection Techniques

Subfield: Software

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

Funders: European Commission, Generalitat de Catalunya, Ministerio de Ciencia e Innovación

Awards: Virtual Environment and Tool-boxing for Trustworthy Development of RISC-V based Cloud Services, G4617452925, G5014590825, G6330287615