Linux Ransomware Analysis and Detection Using Machine Learning and Deep Learning Approaches

Ransomware is currently attacking individuals and businesses around the world. One of the serious issues with new malware is that hackers can hide their malware in the system by using developed concealment techniques like packing and obfuscation. As a result, computer systems must be protected from such malware by employing a ransomware detection system before it infects numerous systems in the cloud environment, thereby affecting many consumers. In this study, the dataset is built from Linux ransomware samples and legitimate ELF files. The features are extracted using static analysis techniques. In addition, 26 families of Linux ransomware are included in the dataset from 2015 to 2023. Preprocessing and feature selection are applied to the dataset to obtain a more accurate model. Finally, ransomware is detected using classical machine learning and deep learning models: XGBoost, CatBoost, Random Forest, Voting Ensemble, Bagging Ensemble, and CNN. A comparative study between these algorithms is conducted and evaluated based on the highest accuracy rate and the shortest training time. This study concludes that CNN and Bagging Ensemble are the most accurate among the other algorithms, with 97.78%. However, the CNN classifier performs better than the bagging ensemble classifier in terms of training time.