# Ransomware Detection Using Machine Learning in the Linux Kernel

arXiv: https://arxiv.org/abs/2409.06452 · HTML: https://mlsanity.com/paper/2409.06452/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 10 references that are in the map.
- First posted on arXiv 10 Sep 2024.

## Builds on (most cited first, 1 of 1)

- [A flow-based IDS using Machine Learning in eBPF](https://mlsanity.com/paper/2102.09980/) (2021)

## Built on by (most cited first, 2 of 2)

- [Building a Robust Risk-Based Access Control System to Combat Ransomware's Capability to Encrypt](https://mlsanity.com/paper/2601.16795/) (2026)
- [Machine Learning (ML) library in Linux kernel](https://mlsanity.com/paper/2603.02145/) (2026)

## Abstract (arXiv)

Linux-based cloud environments have become lucrative targets for ransomware attacks, employing various encryption schemes at unprecedented speeds. Addressing the urgency for real-time ransomware protection, we propose leveraging the extended Berkeley Packet Filter (eBPF) to collect system call information regarding active processes and infer about the data directly at the kernel level. In this study, we implement two Machine Learning (ML) models in eBPF - a decision tree and a multilayer perceptron. Benchmarking latency and accuracy against their user space counterparts, our findings underscore the efficacy of this approach.