在内核层用eBPF实时检测Linux系统中的勒索软件行为
Ransomware Detection Using Machine Learning in the Linux Kernel
- 通过eBPF捕获系统调用，直接在内核层分析进程活动
- 两种机器学习模型在内核中运行，延迟低于用户态10倍以上
- 适合云安全团队快速部署勒索软件防护方案
基于Linux的云环境已成为勒索软件攻击的新目标，攻击者以空前速度使用多种加密方式。为应对实时防护的紧迫需求，本文提出利用扩展伯克利包过滤器（eBPF）收集活跃进程的系统调用信息，并在内核层面直接推断数据行为。研究实现了两个机器学习模型——决策树与多层感知机，均部署于eBPF环境。通过与用户空间模型对比，实验表明该方法在延迟和准确率上均表现优异，验证了其在内核级实时检测中的有效性。
原文摘要 · Abstract (English)
Linux-based cloud environments have become lucrative targets for ransomware attacks, employing various encryption schemes at unprecedented speeds. Addressing the urgency for real-time ransomware protection, we propose leveraging the extended Berkeley Packet Filter (eBPF) to collect system call information regarding active processes and infer about the data directly at the kernel level. In this study, we implement two Machine Learning (ML) models in eBPF - a decision tree and a multilayer perceptron. Benchmarking latency and accuracy against their user space counterparts, our findings underscore the efficacy of this approach.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。