KERNEL-LEVEL MACHINE LEARNING BASED DETECTION OF QILIN RANSOMWARE (RANSOMWARE-AS-A-SERVICE)

Abstract

Ransomware attacks have emerged as one of the most critical threats in modern cybersecurity, the rise of Ransomware-as-a-Service (RaaS) platforms has made sophisticated ransomware toolkits widely accessible. Qilin ransomware stands out as a particularly dangerous variant that leverages Bring Your Own Vulnerable Driver (BYOVD) techniques to achieve kernel-level privilege escalation, effectively bypassing conventional endpoint security measures. This paper presents a comprehensive framework for monitoring and analyzing ransomware behavior using machine learning techniques operating at the kernel level. The proposed solution employs extended Berkeley Packet Filter(eBPF) programs running within the kernel to collect detailed traces of processes, system calls, and file system operations. A carefully designed feature extraction pipeline transforms raw telemetry into discriminative behavioral characteristics, enabling the detection of ransomware-specific patterns even during early infection stages. Three machine learning classifiers, namely Random Forest, XGBoost, and Support Vector Machine (SVM), were systematically evaluated on a dataset comprising 18,000 observation windows of both normal system activities and simulated Qilin ransomware behavioral patterns. Experimental results demonstrate that XGBoost achieves the highest detection accuracy of 98.86% with a detection latency of just 1.8 milliseconds, making real-time kernel-level ransomware detection practically feasible. The integration of kernel-level monitoring with optimized machine learning classifiers represents a novel contribution that offers robust defense against advanced RaaS threats without reliance on signature-based detection.