Review · IEEE International Conference on Smart Information Systems and Technologies · May 13, 2026

A Systematic Review and Taxonomy of Machine Learning Approaches for Static Malware Detection in Linux ELF Binaries

Yersultan Serimbetov, Yunkyung Lee, Amanzholova Saule Toksanovna, Jeong Won Kang, Serik Aisulu, Assel Mukasheva

Abstract

The growing adoption of Linux across IoT, cloud and embedded domains have increased malware threats targeting the Executable and Linkable Format (ELF), making effective detection essential. Recent research published between 2020 and 2025 on static malware detection in ELF binaries is analyzed, examining feature extraction methods, machine learning algorithms, datasets and performance metrics. A comprehensive taxonomy is proposed, categorizing approaches by feature types (header based, section based, opcode based and hybrid), ML techniques (traditional, deep learning and ensemble methods) and application domains (IoT, cloud, industrial systems). The analysis reveals that deep learning models, particularly CNNs and LSTMs, achieve superior performance$(95-99 {\%}$accuracy) but face challenges in adversarial resilience and cross architecture generalization. This study identifies critical gaps including limited public datasets, inadequate evaluation of packed/obfuscated malware and insufficient consideration of real-world deployment constraints. The findings provide researchers and practitioners with a structured understanding of the current state and future directions in ELF malware detection.

Advanced Malware Detection TechniquesSecurity and Verification in ComputingSoftware Engineering Researchmachine learning classificationmalware taxonomybinary analysis

A Systematic Review and Taxonomy of Machine Learning Approaches for Static Malware Detection in Linux ELF Binaries

Abstract

More by Assel Mukasheva