Aayush Srivastava,
Yash Upadhyay,
Krishna Garg,
Aniket Kumar Singh,
Sonu Kumar Thakur,
Vikram Kapoor,
- Student, Department of Computer Science and Engineering, Greater Noida Institute of Technology (GNIT), Uttar Pradesh, India
- Student, Department of Computer Science and Engineering, Greater Noida Institute of Technology (GNIT), Uttar Pradesh, India
- Student, Department of Computer Science and Engineering, Greater Noida Institute of Technology (GNIT), Uttar Pradesh, India
- Student, Department of Computer Science and Engineering, Greater Noida Institute of Technology (GNIT), Uttar Pradesh, India
- Student, Department of Computer Science and Engineering, Greater Noida Institute of Technology (GNIT), Uttar Pradesh, India
- Student, Department of Computer Science and Engineering, Greater Noida Institute of Technology (GNIT), Uttar Pradesh, India
Abstract
With the rapid growth of Linux-based systems across cloud computing, Internet of Things (IoT) devices, servers, and embedded platforms, Linux environments have increasingly become attractive targets for sophisticated malware attacks. This survey provides a comprehensive review of Artificial Intelligence (AI)-based approaches for detecting Linux malware, focusing on research published between 2022 and 2026. More than 40 different detection methodologies are examined, covering both traditional Machine Learning (ML) techniques, such as Random Forest, Support Vector Machines (SVM), and related classifiers, and advanced Deep Learning (DL) approaches, including Convolutional Neural Networks (CNNs), Graph Neural Networks (GNNs), and Transformer-based models such as BERT and large language models (LLMs). Particular attention is given to the growing shift from static malware analysis toward behavioral detection, especially through the examination of system call traces and runtime activities. The increasing use of eBPF is also discussed because of its potential to provide efficient, real-time visibility into Linux system behavior with relatively low performance overhead. The reviewed approaches are compared according to important factors such as detection accuracy, computational cost, scalability, adaptability, and resilience to adversarial attacks. Despite significant progress, several challenges remain, including limited availability of standardized Linux malware datasets, difficulties in reproducing experimental results, high computational requirements of some DL models, and insufficient use of Explainable AI (XAI). Based on these findings, the survey identifies key research gaps and outlines promising directions for developing more accurate, efficient, transparent, and robust AI-driven Linux malware detection systems.
Keywords: Linux malware detection, artificial intelligence, deep learning, system call analysis, eBPF, explainable AI
[This article belongs to Journal of Operating Systems Development & Trends ]
References
1. Sharma S, Gupta N, Bundela B. A GWO-XGBoost machine learning classifier for detecting malware executables. In: 2023 International Conference on Disruptive Technologies (ICDT); 2023 May 11. IEEE; 2023. p. 247-51. Available from: https://ieeexplore.ieee.org/document/10150993
2. Singh A, Mushtaq Z, Abosaq HA, Mursal SNF, Irfan M, Nowakowski G. Enhancing ransomware attack detection using transfer learning and deep learning ensemble models on cloud-encrypted data. Electronics (Basel). 2023;12(18):3899. Available from: https://www.mdpi.com/2079-9292/12/18/3899
3. Tian D, Ma R, Jia X, Hu C. A kernel rootkit detection approach based on virtualization and machine learning. IEEE Access. 2019;7:91657-66.
4. Shim HJ, Jung JW, Kinnunen T, Evans N, Bonastre JF, Lapidot I. a-DCF: an architecture agnostic metric with application to spoofing-robust speaker verification [Preprint]. 2024. arXiv:2403.01355.
5. Landman T, Nissim N. Deep-Hook: a trusted deep learning-based framework for unknown malware detection and classification in Linux cloud environments. Neural Netw. 2021;144:648-85.
6. Ramamoorthy J, Gupta K, Kafle RC, Shashidhar NK, Varol C. A novel static analysis approach using system calls for Linux IoT malware detection. Electronics (Basel). 2024;13(15):2906.
7. Alqahtani A, Sheldon FT. A survey of crypto ransomware attack detection methodologies: an evolving outlook. Sensors (Basel). 2022;22(5):1837.
8. Xu P, Zhang Y, Eckert C, Zarras A. HawkEye: cross-platform malware detection with representation learning on graphs. In: International Conference on Artificial Neural Networks; 2021 Sep 7. Cham: Springer International Publishing; 2021. p. 127-38.
9. Nguyen HT, Ngo QD, Le VH. IoT botnet detection approach based on PSI graph and DGCNN classifier. In: 2018 IEEE International Conference on Information Communication and Signal Processing (ICICSP); 2018 Sep 28. IEEE; 2018. p. 118-22.
10. Bussmann B, Leask P, Nanda N. BatchTopK sparse autoencoders [Preprint]. 2024. arXiv:2412.06410.
11. Rahali A, Akhloufi MA. MalBERTv2: code aware BERT-based model for malware identification. Big Data Cogn Comput. 2023;7(2):60.
12. Akhtar S, Khan S, Parkinson S. LLM-based event log analysis techniques: a survey [Preprint]. 2025. arXiv:2502.00677.
13. Akuthota UC, Bhargava L. Transformer-based intrusion detection for IoT networks. IEEE Internet Things J. 2025;12(5):6062-7.
14. Huang W, Lin C, Xiang L, Zhang Z, Meng G, Xue L, et al. Malfocus: locating malicious modules in malware based on hybrid deep learning. IEEE Trans Dependable Secure Comput. 2025;22(5):5060-76.
15. Rey V, Sánchez PM, Celdrán AH, Bovet G. Federated learning for malware detection in IoT devices. Comput Netw. 2022;204:108693.
16. Brodzik A, Malec-Kruszyński T, Niewolski W, Tkaczyk M, Bocianiak K, Loui SY. Ransomware detection using machine learning in the Linux kernel [Preprint]. 2024. arXiv:2409.06452.
17. Kim R, Ryu J, Kim S, Lee S, Kim S. Detecting cryptojacking containers using eBPF-based security runtime and machine learning. Electronics (Basel). 2025;14(6):1208.
18. Gantikow H, Reich C, Knahl M, Clarke NL. Rule-based security monitoring of containerized workloads. In: CLOSER 2019; 2019 May 2. p. 543-50.
19. The Hacker News. New Linux rootkit PUMAKIT uses advanced stealth techniques to evade detection [Internet]. daily.dev; 2024. Available from: https://daily.dev/posts/new-linux-rootkit-pumakit-uses-advanced-stealth-techniques-to-evade-detection-q4wb9qedf
20. Lin HY, Biggio B. Adversarial machine learning: attacks from laboratories to the real world. Computer. 2021;54(5):56-60.
Journal of Operating Systems Development & Trends
| Volume | 13 | |
| Issue | 02 | |
| Received | 24/06/2026 | |
| Accepted | 05/08/2026 | |
| Published | 28/08/2026 | |
| Publication Time | 65 Days |