用内核追踪数据训练模型，99.28%准确率识别加密行为
Exploiting ftrace's function_graph Tracer Features for Machine Learning: A Case Study on Encryption Detection
- 利用ftrace函数调用图生成系统级特征
- 在真实数据上实现99.28%的加密检测准确率
- 适合系统安全与异常检测方向研究者
本文提出利用Linux内核ftrace框架中的函数调用图追踪器，生成适用于机器学习的系统级数据。在真实世界的加密检测任务中，通过函数调用轨迹和图结构特征，多种学习算法均表现出色。实验结果显示，该方法在大规模文件数据集上的加密活动检测准确率达到99.28%，验证了函数图追踪器特征的有效性。进一步在多标签分类任务中，成功从追踪数据中识别运行程序，证明其泛化能力。本文还提供了原始追踪数据预处理与图特征提取的完整方法，推动了机器学习在系统行为分析、程序识别与异常检测中的应用。通过连接系统追踪与机器学习，为性能监控与安全分析提供新范式。
原文摘要 · Abstract (English)
This paper proposes using the Linux kernel ftrace framework, particularly the function graph tracer, to generate informative system level data for machine learning (ML) applications. Experiments on a real world encryption detection task demonstrate the efficacy of the proposed features across several learning algorithms. The learner faces the problem of detecting encryption activities across a large dataset of files, using function call traces and graph based features. Empirical results highlight an outstanding accuracy of 99.28 on the task at hand, underscoring the efficacy of features derived from the function graph tracer. The results were further validated in an additional experiment targeting a multilabel classification problem, in which running programs were identified from trace data. This work provides comprehensive methodologies for preprocessing raw trace data and extracting graph based features, offering significant advancements in applying ML to system behavior analysis, program identification, and anomaly detection. By bridging the gap between system tracing and ML, this paper paves the way for innovative solutions in performance monitoring and security analytics.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。