Is it Encrypted? - Exploiting ftrace's function_graph Tracer and System Sensors Features for Detection of Encryption

A crucial aspect of this research is the development of a dataset that accurately represents cryptographic operations and their contextual execution within an enterprise system, enabling the distinction between encryption-related activities and normal operations. Traditional datasets for malware and ransomware detection often focus on static indicators or network behavior; however, these approaches fall short of capturing low-level system interactions, particularly the function-call patterns that define cryptographic routines. To bridge this gap, we constructed a dataset using ftrace, a Linux kernel tracing framework, with a specific focus on the function graph tracer while collecting sensor information about the utilization of CPU, memory, and disk. The tracer provides fine-grained function call sequences that, combined with sensor data, offer a unique opportunity to model cryptographic behaviors dynamically. This dataset provides the necessary input for training andevaluating machine learning models capable of distinguishing encryption behaviors. The dataset was collected by executing a diverse set of programs, including benign applications, cryptographic utilities, and ransomware samples, in a controlled environment.The environment consisted of Linux virtual environments running all major kernel versions, starting with 4.11 up to 6.2, in order to capture kernel function call varieties and possible changes between versions. The objective is to capture the precise execution flow of functions involved in encryption, decryption, and general file operations, focusing on the first ~1Mb consumed (written or read) by the process being monitored.