Analyzing the performance of long short-term memory architectures for malware detection models

Date

2023-03-10

Author

Avcı, Çiğdem
Tekinerdogan, Bedir
Çatal, Çağatay

Metadata

Show full item record

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Item Usage Stats

93
views

155
downloads

Cite This

Malicious software forms a threat to many software-intensive systems and as such several malware detection approaches have been introduced, often based on sequential data analysis. Long short-term memory (LSTM) is an artificial recurrent neural network (RNN) architecture that is effective for sequential data analysis, however, no study has yet analyzed the performance of different LSTM architectures for the application of malware detection. In this article, we aim to evaluate and benchmark the performance of LSTM-based malware detection approaches on specific LSTM architectures to provide insight into malware detection. Our method builds LSTM-based malware prediction models and performs experiments using different LSTM architectures including Vanilla LSTM, stacked LSTM, bi-directional LSTM, and CNN-LSTM. We evaluated the performance of each of these architectures and different configurations. Our study, as a contribution, shows that Bidirectional LSTM with hyperparameter optimization is found to be overperforming other selected LSTM architectures. This study shows that different LSTM approaches and architectures are applicable to the malware detection problem. Quality attributes such as efficiency and accuracy, and the software system architecture adopted for the implementation impact the selection of the LSTM approach.

Subject Keywords

deep learning, LSTM, machine learning, malware detection, prediction

URI

https://hdl.handle.net/11511/109993

Collections

Department of Computer Engineering, Article