Evaluating Anti-Virus Effectiveness in Linux
Giuseppe Raffa, Daniele Sgandurra, Dan O’Keeffe · 2022 IEEE International Conference on Big Data (Big Data) · 2022
Anti-virus (AV) software is widely recognized as one of the most important defensive tools against malware. Although historically many Linux users considered this operating system to be malware-free, recent research suggests that Linux malware is on the rise. However, to date there has not been a comprehensive observational study on the effectiveness of modern Linux AVs.In this work, we evaluate a range of Linux AVs using a dataset of 43,553 Linux malware samples, conducting our analysis over a period of ten months to identify possible regression effects. We measure the detection rates of Linux AVs available in our local test environment and on an online malware scanning service. Furthermore, we perform a Linux malware capability analysis using the open-source tool CAPA. Overall, the results of this work show that Linux AVs’ signature databases are not well maintained by AV vendors, and that several Linux AVs are affected by regression. In addition, our capability analysis suggests that malware authors are trying to further specialize existing approaches for evading AV software rather than developing new capabilities.