Scholarlink

<p>Malware targeting Linux-based environments is increasingly stealthy and polymorphic, challenging the effectiveness of conventional detection techniques. These methods often struggle with modeling high-dimensional system-level data and fail to capture complex patterns in process-level telemetry. Despite recent progress in deep learning-based detection, the majority of existing approaches focus on Windows or Android platforms and rely on static feature representations, leaving Linux process-level telemetry as an underexplored modality. In this study, a single-encoder Transformer architecture is proposed, employing multi-head self-attention to model structured, process-level features derived from Linux kernel instrumentation. The proposed model processes a curated and balanced dataset of 100,000 publicly available, process-level telemetry records comprising 35 process-level and system behavior attributes. After preprocessing, normalization, and correlation-based feature selection, the model is trained on an 80/20 stratified split and evaluated across five independent runs to ensure statistical reliability. The proposed model is evaluated against widely used traditional machine learning and deep learning baselines, including Random Forest (F1-score: 0.79), Support Vector Machines (F1-score: 0.75), a 1D-CNN (F1-score: 0.90), and an LSTM network (F1-score: 0.93). The Transformer achieves an accuracy of 0.99, a precision of 1.00, recall of 0.99, and F1-score of 0.99, outperforming all baselines by up to 32 percentage points in F1-score. Ablation studies demonstrate that removing positional encoding reduces the F1-score by 3.03%, omitting feature normalization results in a 5.05% drop, and decreasing model depth causes a 4.04% decline. These findings confirm the importance of each architectural component and validate the utility of Transformer architectures for scalable and accurate malware detection in Linux environments.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Transformer-based deep learning framework for malware detection in Linux environments using structured process-level features

  • 期刊论文

  • 发表日期：

    2026年6月1日

查看全文
  • Obieda Ananbeh,
  • Wala Alnozami

摘要

Malware targeting Linux-based environments is increasingly stealthy and polymorphic, challenging the effectiveness of conventional detection techniques. These methods often struggle with modeling high-dimensional system-level data and fail to capture complex patterns in process-level telemetry. Despite recent progress in deep learning-based detection, the majority of existing approaches focus on Windows or Android platforms and rely on static feature representations, leaving Linux process-level telemetry as an underexplored modality. In this study, a single-encoder Transformer architecture is proposed, employing multi-head self-attention to model structured, process-level features derived from Linux kernel instrumentation. The proposed model processes a curated and balanced dataset of 100,000 publicly available, process-level telemetry records comprising 35 process-level and system behavior attributes. After preprocessing, normalization, and correlation-based feature selection, the model is trained on an 80/20 stratified split and evaluated across five independent runs to ensure statistical reliability. The proposed model is evaluated against widely used traditional machine learning and deep learning baselines, including Random Forest (F1-score: 0.79), Support Vector Machines (F1-score: 0.75), a 1D-CNN (F1-score: 0.90), and an LSTM network (F1-score: 0.93). The Transformer achieves an accuracy of 0.99, a precision of 1.00, recall of 0.99, and F1-score of 0.99, outperforming all baselines by up to 32 percentage points in F1-score. Ablation studies demonstrate that removing positional encoding reduces the F1-score by 3.03%, omitting feature normalization results in a 5.05% drop, and decreasing model depth causes a 4.04% decline. These findings confirm the importance of each architectural component and validate the utility of Transformer architectures for scalable and accurate malware detection in Linux environments.