ELF-Miner: using structural knowledge and data mining methods to detect new (Linux) malicious executables

Abstract

Abstract. Linux malware can pose a significant threat -its (Linux) penetration is exponentially increasing -because little is known or understood about their vulnerabilities. We believe that now is the right time to devise non-signature based zero-day (previously unknown) malware detection strategies before Linux intruders take us by surprise. Therefore, in this paper, we first do a forensic analysis of Linux executable and linkable format (ELF) files. Our forensic analysis provides insight into different features that have the potential to discriminate malware executables from benign ones. As a result, we can select a features' set of 383 features that are extracted from an ELF header. We quantify the classification potential of features using information gain and then remove redundant features by employing pre-processing filters. Finally, we do an extensive evaluation among classical rule based machine learning classifiers -RIPPER, PART, C4.5 Rules and decision tree J48 -and bio-inspired classifiers -cAnt Miner, UCS, XCS, and GAssist -to select the best classifier for our system. We have evaluated our approach on an available collection of 709 Linux malware samples from vx heavens and offensive computing. Our experiments show that ELF-Miner provides more than 99% detection accuracy with less than 0.1% false alarm rate.

Linux malware detection using non-parametric statistical methods

“…we can observe from Table V that the n-gram based method IMAD obtained 77% accuracy with n=6 and Hyper-grams technique obtained maximum accuracy 87.85 % with variable length n-grams. Another method using genetic footprint [17] [18] which using informations from the task structures of Linux OS obtained a 96% accuracy for top 16 features. In comparison, our novel proposed methodology achieves a detection acuracy of 97.3% with top 10 optimal features which considerably reduce the detection time as well as the need of storage.…”

“…The authors in [17] proposed a new approach for Linux malware detection by mining the collection of features from ELF headers of Linux executables. Well-known classifiers implemented in WEKA [14][1] were used to evaluate the method.…”

Linux Malware Detection Using eXtended–Symmetric Uncertainty

“…The methodology is a threefold approach comprising of (a) features selection (b) elimination of redundant features and (c) classification using data mining techniques. The author in [10] proposed a new approach for Linux malware detection by mining feature set collected from ELF headers of Linux executables. Also, a number of well-known classifiers implemented in WEKA [7][13] to evaluate the method.…”

IoT Malware Analysis and New Pattern Discovery Through Sequence Analysis Using Meta-Feature Information

“…For Linux/Unix malware, Shahzad and Farooq analyzed 709 Linux executable and linkable format (ELF) files, extracting features from the ELF header and then applying machine-learning classifiers to detect malware. Their method achieved 99% detection accuracy, with a false alarm rate of less than 0.1% [9]. Bai et al gathered features from ELF file system calls and tested four classification algorithms (J48, Random Forests, AdboostM1, and IBK) for detecting Linux malware, achieving a detection accuracy of approximately 98% [10].…”