Linux malware detection using non-parametric statistical methods

Abstract

Linux is the most renowned open source operating system. In recent years, the number of malware targeting Linux OS has been increased and the traditional defence mechanisms seems to be futile. We propose a novel non-parametric statistical approach using machine learning techniques for identifying previously unknown malicious Executable Linkable Files (ELF). The system calls employed as features extracted dynamically within a controlled environment. The proposed approach ranks and determine the prominent features by using non-parametric statistical methods like Kruskal-Wallis ranking test (KW), Deviation From Poisson (DFP). Three learning algorithms (J48, Adaboost and Random Forest) are applied to generate prediction model, from a minimal set of features extracted from the system call traces. Optimal feature vector resulted in over all classification accuracy of 97.30% to identify unknown malicious specimens.

Gaining New Insight into Machine-Learning Datasets via Multiple Binary-Feature Frequency Ranks with a Mobile Benign/Malware Apps Example

“…It was encountered that only one study uses the Kruskal-Wallis test in malware analysis in the literature. Asmitha and Vinod [38] employ the test for selecting prominent features from benign and malign applications on the Linux desktop platform. According to their classification experiment, the Kruskal-Wallis test achieves slightly better than the other feature selection methods.…”