LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach
Not on the map. Why?
Abstract (arXiv)
Long-Short-Term-Memory (LSTM) networks have shown great promise in artificial intelligence (AI) based language modeling. Recently, LSTM networks have also become popular for designing AI-based Intrusion Detection Systems (IDS). However, its applicability in IDS is studied largely in the default settings as used in language models. Whereas security applications offer distinct conditions and hence warrant careful consideration while applying such recurrent networks. Therefore, we conducted one of the most exhaustive works on LSTM hyper-parameters for IDS and experimented with approx. 150 LSTM configurations to determine its hyper-parameters relative importance, interaction effects, and optimal selection approach for designing an IDS. We conducted multiple analyses of the results of these experiments and empirically controlled for the interaction effects of different hyper-parameters covariate levels. We found that for security applications, especially for designing an IDS, neither similar relative importance as applicable to language models is valid, nor is the standard linear method for hyper-parameter selection ideal. We ascertained that the interaction effect plays a crucial role in determining the relative importance of hyper-parameters. We also discovered that after controlling for the interaction effect, the correct relative importance for LSTMs for an IDS is batch-size, followed by dropout ratio and padding. The findings are significant because when LSTM was first used for language models, the focus had mostly been on increasing the number of layers to enhance performance.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 15 of its 34 references that are in the map. First posted on arXiv 23 Sep 2021.
Builds on
15 of 34 references.
References · 15
- 2015LSTM: A Search Space Odysseycited by 315
- 2015Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Featurescited by 48
- 2019Effects of padding on LSTMs and CNNscited by 22
- 2015LSTM-based Deep Learning Models for Non-factoid Answer Selectioncited by 17
- 2017Optimal Hyperparameters for Deep LSTM-Networks for Sequence Labeling Taskscited by 17
- 2021Robust Android Malware Detection System against Adversarial Attacks using Q-Learningcited by 12
- 2017DeepSign: Deep Learning for Automatic Malware Signature Generation and Classificationcited by 8
- 2017Learning the PE Header, Malware Detection with Minimal Domain Knowledgecited by 7
- 2021Identification of Significant Permissions for Efficient Android Malware Detectioncited by 7
- 2019Malware Detection with LSTM using Opcode Languagecited by 6
- 2020DOOM: A Novel Adversarial-DRL-Based Op-Code Level Metamorphic Malware Obfuscator for the Enhancement of IDScited by 6
- 2021Detection of Malicious Android Applications: Classical Machine Learning vs. Deep Neural Network Integrated with Clusteringcited by 4
Built on by
Citing papers per year: 2025: 1.
1 paper.