Research Overview
The growing sophistication of Linux-targeted malware, characterized by stealthy and polymorphic behavior, continues to outpace conventional detection techniques. Traditional approaches frequently struggle to model high-dimensional system-level data and fail to capture the intricate patterns embedded within process-level telemetry. While deep learning has advanced malware detection, the majority of existing efforts concentrate on Windows or Android platforms and depend on static feature representations, leaving Linux process-level telemetry as an underexplored modality. This study introduces a single-encoder Transformer architecture that leverages multi-head self-attention to model structured, process-level features derived from Linux kernel instrumentation, achieving a substantial advance in detection accuracy and reliability.
Methodology and Analytical Approach
The proposed framework is evaluated on a curated and balanced dataset of 100,000 publicly available process-level telemetry records comprising 35 process-level and system behavior attributes. Following preprocessing, normalization, and correlation-based feature selection, the model is trained on an 80/20 stratified split and assessed across five independent runs to ensure statistical robustness. The Transformer is benchmarked against widely adopted traditional and deep learning baselines, including Random Forest (F1-score 0.79), Support Vector Machines (0.75), a 1D-CNN (0.90), and an LSTM network (0.93). It attains an accuracy of 0.99, precision of 1.00, recall of 0.99, and an F1-score of 0.99, surpassing every baseline by as much as 32 percentage points. Ablation studies further isolate the contribution of each component, revealing that removing positional encoding lowers the F1-score by 3.03%, omitting feature normalization by 5.05%, and decreasing model depth by 4.04%.
Implications for Software Security
This work demonstrates that Transformer architectures can deliver scalable and highly accurate malware detection directly from Linux process-level telemetry, a modality long underrepresented in the literature. By validating the necessity of each architectural element, the study provides a principled foundation for deploying attention-based models in operational Linux environments. The publicly released replication package and dataset further enable practitioners and researchers to reproduce, audit, and extend the framework, advancing the development of robust, automation-ready defenses against evolving Linux threats.
Read The Paper