# LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach

arXiv: https://arxiv.org/abs/2109.11500 · HTML: https://mlsanity.com/paper/2109.11500/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 34 references that are in the map.
- First posted on arXiv 23 Sep 2021.

## Builds on (most cited first, 15 of 15)

- [LSTM: A Search Space Odyssey](https://mlsanity.com/paper/1503.04069/) (2015)
- [Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Features](https://mlsanity.com/paper/1508.03096/) (2015)
- [Effects of padding on LSTMs and CNNs](https://mlsanity.com/paper/1903.07288/) (2019)
- [LSTM-based Deep Learning Models for Non-factoid Answer Selection](https://mlsanity.com/paper/1511.04108/) (2015)
- [Optimal Hyperparameters for Deep LSTM-Networks for Sequence Labeling Tasks](https://mlsanity.com/paper/1707.06799/) (2017)
- [Robust Android Malware Detection System against Adversarial Attacks using Q-Learning](https://mlsanity.com/paper/2101.12031/) (2021)
- [DeepSign: Deep Learning for Automatic Malware Signature Generation and Classification](https://mlsanity.com/paper/1711.08336/) (2017)
- [Learning the PE Header, Malware Detection with Minimal Domain Knowledge](https://mlsanity.com/paper/1709.01471/) (2017)
- [Identification of Significant Permissions for Efficient Android Malware Detection](https://mlsanity.com/paper/2103.00643/) (2021)
- [Malware Detection with LSTM using Opcode Language](https://mlsanity.com/paper/1906.04593/) (2019)
- [DOOM: A Novel Adversarial-DRL-Based Op-Code Level Metamorphic Malware Obfuscator for the Enhancement of IDS](https://mlsanity.com/paper/2010.08608/) (2020)
- [Detection of Malicious Android Applications: Classical Machine Learning vs. Deep Neural Network Integrated with Clustering](https://mlsanity.com/paper/2103.00637/) (2021)
- [An investigation of a deep learning based malware detection system](https://mlsanity.com/paper/1809.05888/) (2018)
- [DRLDO: A novel DRL based De-ObfuscationSystem for Defense against Metamorphic Malware](https://mlsanity.com/paper/2102.00898/) (2021)
- [Assessment of the Relative Importance of different hyper-parameters of LSTM for an IDS](https://mlsanity.com/paper/2012.14427/) (2020)

## Built on by (most cited first, 1 of 1)

- [Comprehensive Attribute Encoding and Dynamic LSTM HyperModels for Outcome Oriented Predictive Business Process Monitoring](https://mlsanity.com/paper/2506.03696/) (2025)

## Abstract (arXiv)

Long-Short-Term-Memory (LSTM) networks have shown great promise in artificial intelligence (AI) based language modeling. Recently, LSTM networks have also become popular for designing AI-based Intrusion Detection Systems (IDS). However, its applicability in IDS is studied largely in the default settings as used in language models. Whereas security applications offer distinct conditions and hence warrant careful consideration while applying such recurrent networks. Therefore, we conducted one of the most exhaustive works on LSTM hyper-parameters for IDS and experimented with approx. 150 LSTM configurations to determine its hyper-parameters relative importance, interaction effects, and optimal selection approach for designing an IDS. We conducted multiple analyses of the results of these experiments and empirically controlled for the interaction effects of different hyper-parameters covariate levels. We found that for security applications, especially for designing an IDS, neither similar relative importance as applicable to language models is valid, nor is the standard linear method for hyper-parameter selection ideal. We ascertained that the interaction effect plays a crucial role in determining the relative importance of hyper-parameters. We also discovered that after controlling for the interaction effect, the correct relative importance for LSTMs for an IDS is batch-size, followed by dropout ratio and padding. The findings are significant because when LSTM was first used for language models, the focus had mostly been on increasing the number of layers to enhance performance.