BarongTrace: A Malware Event Log Dataset for Linux

Previous research that develops a machine learning malware detection model on Linux operating system typically evaluated their approach by using a dataset generated by running a small amount of malware samples. It may cause issues with not having enough data to train and evaluate the model. Thus, the result may not be applicable in the real world. Other issues with the previous research are that they focus on machine-level data (e.g., CPU, memory, and network usage) to identify malware and most of the detection models were trained with Windows-based malware. Therefore, in this research, we generated a dataset by running malicious and benign Linux ELF files on Cuckoo Sandbox. We captured the events generated by running processes with Sysmon for Linux. Sysmon collects various events such as process creation, network connection, file modification, file creation, and DNS queries. The resulting dataset (BarongTrace) consists of events that were populated by executing 22,784 ELF files successfully; 10,414 of them are benign and 12,370 of the rest are malicious. The biggest amount of dynamic analysis malware samples. Apart from merely generating a dataset, we also looked at the Sysmon event log generated by samples running on Windows and Linux. We notice several significant differences in the Windows and Linux data. This data discrepancy led to lower malware prediction results as shown in our experiments. When we used the Linux dataset on the pre-trained Windows malware detection machine learning model, the F1 score dropped up to 0.54 points. Therefore, we hope that this finding and our proposed dataset can contribute to the development of a more accurate machine learning-based malware detection model for Linux operating systems.