LARM: Linux Anti Ransomware Monitor

Abstract

As Linux becomes more prevalent across servers, desktops, and cloud infrastructures, ransomware groups increasingly focus on targeting Linux-based systems, particularly those running on widely deployed x86 architectures. However, research on real-time, lightweight ransomware detection for Linux systems remains limited. The existing approaches, based on file backups, trap or decoy files, and file I/O behavior monitoring, are found to be ineffective against multithreaded ransomware variants, often leading to delayed detection and false positives. In this work, we introduce LARM (Linux Anti-Ransomware Monitor), a lightweight, real-time detection tool tailored for Linux systems with x86_64 architecture. LARM employs a file trap monitoring module that operates at the kernel level using eBPF (extended Berkeley Packet Filter) to detect real-time ransomware activity. LARM dynamically selects trap files for monitoring through a non-parametric clustering approach of Affinity Propagation, combined with the encryption order heuristics observed in ransomware behavior. Since sole reliance on trap file monitoring may result in false positives, LARM integrates a secondary profiling mechanism that analyzes pre-encryption ransomware activity in real-time. We evaluated LARM against 14 modern Linux ransomware families, including multithreaded versions of Avos Locker and Babuk. The evaluation results demonstrate an average detection delay of 1,240 ms and a file loss rate of 0.46%, highlighting the effectiveness of LARM in early detection and mitigation of ransomware in Linux systems.