{"data":{"id":"10.48550/arxiv.2012.14427","type":"dois","attributes":{"doi":"10.48550/arxiv.2012.14427","prefix":"10.48550","suffix":"arxiv.2012.14427","identifiers":[{"identifier":"2012.14427","identifierType":"arXiv"}],"alternateIdentifiers":[{"alternateIdentifierType":"arXiv","alternateIdentifier":"2012.14427"}],"creators":[{"name":"Sewak, Mohit","nameType":"Personal","givenName":"Mohit","familyName":"Sewak","affiliation":[],"nameIdentifiers":[]},{"name":"Sahay, Sanjay K.","nameType":"Personal","givenName":"Sanjay K.","familyName":"Sahay","affiliation":[],"nameIdentifiers":[]},{"name":"Rathore, Hemant","nameType":"Personal","givenName":"Hemant","familyName":"Rathore","affiliation":[],"nameIdentifiers":[]}],"titles":[{"title":"Assessment of the Relative Importance of different hyper-parameters of LSTM for an IDS"}],"publisher":"arXiv","container":{},"publicationYear":2020,"subjects":[{"lang":"en","subject":"Cryptography and Security (cs.CR)","subjectScheme":"arXiv"},{"lang":"en","subject":"Machine Learning (cs.LG)","subjectScheme":"arXiv"},{"subject":"FOS: Computer and information sciences","subjectScheme":"Fields of Science and Technology (FOS)"},{"subject":"FOS: Computer and information sciences","schemeUri":"http://www.oecd.org/science/inno/38235147.pdf","subjectScheme":"Fields of Science and Technology (FOS)"}],"contributors":[],"dates":[{"date":"2020-12-26T18:00:37Z","dateType":"Submitted","dateInformation":"v1"},{"date":"2021-01-01T01:00:06Z","dateType":"Updated","dateInformation":"v1"},{"date":"2020-12","dateType":"Available","dateInformation":"v1"},{"date":"2020","dateType":"Issued"}],"language":null,"types":{"ris":"RPRT","bibtex":"article","citeproc":"article-journal","schemaOrg":"ScholarlyArticle","resourceType":"Article","resourceTypeGeneral":"Text"},"relatedIdentifiers":[{"relationType":"IsVersionOf","relatedIdentifier":"10.1109/tencon50793.2020.9293731","relatedIdentifierType":"DOI"}],"relatedItems":[],"sizes":[],"formats":[],"version":"1","rightsList":[{"rights":"arXiv.org perpetual, non-exclusive license","rightsUri":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/"}],"descriptions":[{"description":"Recurrent deep learning language models like the LSTM are often used to provide advanced cyber-defense for high-value assets. The underlying assumption for using LSTM networks for malware-detection is that the op-code sequence of malware could be treated as a (spoken) language representation. There are differences between any spoken-language (sequence of words/sentences) and the machine-language (sequence of op-codes). In this paper, we demonstrate that due to these inherent differences, an LSTM model with its default configuration as tuned for a spoken-language, may not work well to detect malware (using its op-code sequence) unless the network's essential hyper-parameters are tuned appropriately. In the process, we also determine the relative importance of all the different hyper-parameters of an LSTM network as applied to malware detection using their op-code sequence representations. We experimented with different configurations of LSTM networks, and altered hyper-parameters like the embedding-size, number of hidden layers, number of LSTM-units in a hidden layer, pruning/padding-length of the input-vector, activation-function, and batch-size. We discovered that owing to the enhanced complexity of the malware/machine-language, the performance of an LSTM network configured for an Intrusion Detection System, is very sensitive towards the number-of-hidden-layers, input sequence-length, and the choice of the activation-function. Also, for (spoken) language-modeling, the recurrent architectures by-far outperform their non-recurrent counterparts. Therefore, we also assess how sequential DL architectures like the LSTM compare against their non-sequential counterparts like the MLP-DNN for the purpose of malware-detection.","descriptionType":"Abstract"}],"geoLocations":[],"fundingReferences":[],"xml":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPHJlc291cmNlIHhtbG5zPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCIgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnNjaGVtYUxvY2F0aW9uPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCBodHRwOi8vc2NoZW1hLmRhdGFjaXRlLm9yZy9tZXRhL2tlcm5lbC00LjMvbWV0YWRhdGEueHNkIj4KICA8aWRlbnRpZmllciBpZGVudGlmaWVyVHlwZT0iRE9JIj4xMC40ODU1MC9BUlhJVi4yMDEyLjE0NDI3PC9pZGVudGlmaWVyPgogIDxhbHRlcm5hdGVJZGVudGlmaWVycz4KICAgIDxhbHRlcm5hdGVJZGVudGlmaWVyIGFsdGVybmF0ZUlkZW50aWZpZXJUeXBlPSJhclhpdiI+MjAxMi4xNDQyNzwvYWx0ZXJuYXRlSWRlbnRpZmllcj4KICA8L2FsdGVybmF0ZUlkZW50aWZpZXJzPgogIDxjcmVhdG9ycz4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5TZXdhaywgTW9oaXQ8L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPk1vaGl0PC9naXZlbk5hbWU+CiAgICAgIDxmYW1pbHlOYW1lPlNld2FrPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPlNhaGF5LCBTYW5qYXkgSy48L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPlNhbmpheSBLLjwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5TYWhheTwvZmFtaWx5TmFtZT4KICAgIDwvY3JlYXRvcj4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5SYXRob3JlLCBIZW1hbnQ8L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPkhlbWFudDwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5SYXRob3JlPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogIDwvY3JlYXRvcnM+CiAgPHRpdGxlcz4KICAgIDx0aXRsZT5Bc3Nlc3NtZW50IG9mIHRoZSBSZWxhdGl2ZSBJbXBvcnRhbmNlIG9mIGRpZmZlcmVudCBoeXBlci1wYXJhbWV0ZXJzIG9mIExTVE0gZm9yIGFuIElEUzwvdGl0bGU+CiAgPC90aXRsZXM+CiAgPHB1Ymxpc2hlcj5hclhpdjwvcHVibGlzaGVyPgogIDxwdWJsaWNhdGlvblllYXI+MjAyMDwvcHVibGljYXRpb25ZZWFyPgogIDxzdWJqZWN0cz4KICAgIDxzdWJqZWN0IHhtbDpsYW5nPSJlbiIgc3ViamVjdFNjaGVtZT0iYXJYaXYiPkNyeXB0b2dyYXBoeSBhbmQgU2VjdXJpdHkgKGNzLkNSKTwvc3ViamVjdD4KICAgIDxzdWJqZWN0IHhtbDpsYW5nPSJlbiIgc3ViamVjdFNjaGVtZT0iYXJYaXYiPk1hY2hpbmUgTGVhcm5pbmcgKGNzLkxHKTwvc3ViamVjdD4KICAgIDxzdWJqZWN0IHN1YmplY3RTY2hlbWU9IkZpZWxkcyBvZiBTY2llbmNlIGFuZCBUZWNobm9sb2d5IChGT1MpIj5GT1M6IENvbXB1dGVyIGFuZCBpbmZvcm1hdGlvbiBzY2llbmNlczwvc3ViamVjdD4KICA8L3N1YmplY3RzPgogIDxkYXRlcz4KICAgIDxkYXRlIGRhdGVUeXBlPSJTdWJtaXR0ZWQiIGRhdGVJbmZvcm1hdGlvbj0idjEiPjIwMjAtMTItMjZUMTg6MDA6MzdaPC9kYXRlPgogICAgPGRhdGUgZGF0ZVR5cGU9IlVwZGF0ZWQiIGRhdGVJbmZvcm1hdGlvbj0idjEiPjIwMjEtMDEtMDFUMDE6MDA6MDZaPC9kYXRlPgogICAgPGRhdGUgZGF0ZVR5cGU9IkF2YWlsYWJsZSIgZGF0ZUluZm9ybWF0aW9uPSJ2MSI+MjAyMC0xMjwvZGF0ZT4KICA8L2RhdGVzPgogIDxyZXNvdXJjZVR5cGUgcmVzb3VyY2VUeXBlR2VuZXJhbD0iVGV4dCI+QXJ0aWNsZTwvcmVzb3VyY2VUeXBlPgogIDxyZWxhdGVkSWRlbnRpZmllcnM+CiAgICA8cmVsYXRlZElkZW50aWZpZXIgcmVsYXRlZElkZW50aWZpZXJUeXBlPSJET0kiIHJlbGF0aW9uVHlwZT0iSXNWZXJzaW9uT2YiPjEwLjExMDkvVEVOQ09ONTA3OTMuMjAyMC45MjkzNzMxPC9yZWxhdGVkSWRlbnRpZmllcj4KICA8L3JlbGF0ZWRJZGVudGlmaWVycz4KICA8dmVyc2lvbj4xPC92ZXJzaW9uPgogIDxyaWdodHNMaXN0PgogICAgPHJpZ2h0cyByaWdodHNVUkk9Imh0dHA6Ly9hcnhpdi5vcmcvbGljZW5zZXMvbm9uZXhjbHVzaXZlLWRpc3RyaWIvMS4wLyI+YXJYaXYub3JnIHBlcnBldHVhbCwgbm9uLWV4Y2x1c2l2ZSBsaWNlbnNlPC9yaWdodHM+CiAgPC9yaWdodHNMaXN0PgogIDxkZXNjcmlwdGlvbnM+CiAgICA8ZGVzY3JpcHRpb24gZGVzY3JpcHRpb25UeXBlPSJBYnN0cmFjdCI+UmVjdXJyZW50IGRlZXAgbGVhcm5pbmcgbGFuZ3VhZ2UgbW9kZWxzIGxpa2UgdGhlIExTVE0gYXJlIG9mdGVuIHVzZWQgdG8gcHJvdmlkZSBhZHZhbmNlZCBjeWJlci1kZWZlbnNlIGZvciBoaWdoLXZhbHVlIGFzc2V0cy4gVGhlIHVuZGVybHlpbmcgYXNzdW1wdGlvbiBmb3IgdXNpbmcgTFNUTSBuZXR3b3JrcyBmb3IgbWFsd2FyZS1kZXRlY3Rpb24gaXMgdGhhdCB0aGUgb3AtY29kZSBzZXF1ZW5jZSBvZiBtYWx3YXJlIGNvdWxkIGJlIHRyZWF0ZWQgYXMgYSAoc3Bva2VuKSBsYW5ndWFnZSByZXByZXNlbnRhdGlvbi4gVGhlcmUgYXJlIGRpZmZlcmVuY2VzIGJldHdlZW4gYW55IHNwb2tlbi1sYW5ndWFnZSAoc2VxdWVuY2Ugb2Ygd29yZHMvc2VudGVuY2VzKSBhbmQgdGhlIG1hY2hpbmUtbGFuZ3VhZ2UgKHNlcXVlbmNlIG9mIG9wLWNvZGVzKS4gSW4gdGhpcyBwYXBlciwgd2UgZGVtb25zdHJhdGUgdGhhdCBkdWUgdG8gdGhlc2UgaW5oZXJlbnQgZGlmZmVyZW5jZXMsIGFuIExTVE0gbW9kZWwgd2l0aCBpdHMgZGVmYXVsdCBjb25maWd1cmF0aW9uIGFzIHR1bmVkIGZvciBhIHNwb2tlbi1sYW5ndWFnZSwgbWF5IG5vdCB3b3JrIHdlbGwgdG8gZGV0ZWN0IG1hbHdhcmUgKHVzaW5nIGl0cyBvcC1jb2RlIHNlcXVlbmNlKSB1bmxlc3MgdGhlIG5ldHdvcmsncyBlc3NlbnRpYWwgaHlwZXItcGFyYW1ldGVycyBhcmUgdHVuZWQgYXBwcm9wcmlhdGVseS4gSW4gdGhlIHByb2Nlc3MsIHdlIGFsc28gZGV0ZXJtaW5lIHRoZSByZWxhdGl2ZSBpbXBvcnRhbmNlIG9mIGFsbCB0aGUgZGlmZmVyZW50IGh5cGVyLXBhcmFtZXRlcnMgb2YgYW4gTFNUTSBuZXR3b3JrIGFzIGFwcGxpZWQgdG8gbWFsd2FyZSBkZXRlY3Rpb24gdXNpbmcgdGhlaXIgb3AtY29kZSBzZXF1ZW5jZSByZXByZXNlbnRhdGlvbnMuIFdlIGV4cGVyaW1lbnRlZCB3aXRoIGRpZmZlcmVudCBjb25maWd1cmF0aW9ucyBvZiBMU1RNIG5ldHdvcmtzLCBhbmQgYWx0ZXJlZCBoeXBlci1wYXJhbWV0ZXJzIGxpa2UgdGhlIGVtYmVkZGluZy1zaXplLCBudW1iZXIgb2YgaGlkZGVuIGxheWVycywgbnVtYmVyIG9mIExTVE0tdW5pdHMgaW4gYSBoaWRkZW4gbGF5ZXIsIHBydW5pbmcvcGFkZGluZy1sZW5ndGggb2YgdGhlIGlucHV0LXZlY3RvciwgYWN0aXZhdGlvbi1mdW5jdGlvbiwgYW5kIGJhdGNoLXNpemUuIFdlIGRpc2NvdmVyZWQgdGhhdCBvd2luZyB0byB0aGUgZW5oYW5jZWQgY29tcGxleGl0eSBvZiB0aGUgbWFsd2FyZS9tYWNoaW5lLWxhbmd1YWdlLCB0aGUgcGVyZm9ybWFuY2Ugb2YgYW4gTFNUTSBuZXR3b3JrIGNvbmZpZ3VyZWQgZm9yIGFuIEludHJ1c2lvbiBEZXRlY3Rpb24gU3lzdGVtLCBpcyB2ZXJ5IHNlbnNpdGl2ZSB0b3dhcmRzIHRoZSBudW1iZXItb2YtaGlkZGVuLWxheWVycywgaW5wdXQgc2VxdWVuY2UtbGVuZ3RoLCBhbmQgdGhlIGNob2ljZSBvZiB0aGUgYWN0aXZhdGlvbi1mdW5jdGlvbi4gQWxzbywgZm9yIChzcG9rZW4pIGxhbmd1YWdlLW1vZGVsaW5nLCB0aGUgcmVjdXJyZW50IGFyY2hpdGVjdHVyZXMgYnktZmFyIG91dHBlcmZvcm0gdGhlaXIgbm9uLXJlY3VycmVudCBjb3VudGVycGFydHMuIFRoZXJlZm9yZSwgd2UgYWxzbyBhc3Nlc3MgaG93IHNlcXVlbnRpYWwgREwgYXJjaGl0ZWN0dXJlcyBsaWtlIHRoZSBMU1RNIGNvbXBhcmUgYWdhaW5zdCB0aGVpciBub24tc2VxdWVudGlhbCBjb3VudGVycGFydHMgbGlrZSB0aGUgTUxQLUROTiBmb3IgdGhlIHB1cnBvc2Ugb2YgbWFsd2FyZS1kZXRlY3Rpb24uPC9kZXNjcmlwdGlvbj4KICA8L2Rlc2NyaXB0aW9ucz4KPC9yZXNvdXJjZT4=","url":"https://arxiv.org/abs/2012.14427","contentUrl":null,"metadataVersion":0,"schemaVersion":"http://datacite.org/schema/kernel-4","source":"mds","isActive":true,"state":"findable","reason":null,"viewCount":0,"viewsOverTime":[],"downloadCount":0,"downloadsOverTime":[],"referenceCount":0,"citationCount":0,"citationsOverTime":[],"partCount":0,"partOfCount":0,"versionCount":0,"versionOfCount":0,"created":"2022-02-24T07:09:15.000Z","registered":"2022-02-24T07:09:16.000Z","published":"2020","updated":"2022-02-24T07:09:16.000Z"},"relationships":{"client":{"data":{"id":"arxiv.content","type":"clients"}},"provider":{"data":{"id":"arxiv","type":"providers"}},"media":{"data":{"id":"10.48550/arxiv.2012.14427","type":"media"}},"references":{"data":[]},"citations":{"data":[]},"parts":{"data":[]},"partOf":{"data":[]},"versions":{"data":[]},"versionOf":{"data":[]}}}}