LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach

TL;DR

This paper investigates the hyper-parameter selection for LSTM networks in intrusion detection systems, emphasizing the importance of interaction effects and proposing a hierarchical selection approach tailored for security applications.

Contribution

It provides an exhaustive analysis of LSTM hyper-parameters for IDS, highlighting the significance of interaction effects and proposing a novel hierarchical selection method.

Findings

Interaction effects significantly influence hyper-parameter importance.

Batch size, dropout ratio, and padding are the most critical hyper-parameters.

Standard linear methods are inadequate for hyper-parameter selection in IDS.

Abstract

Long-Short-Term-Memory (LSTM) networks have shown great promise in artificial intelligence (AI) based language modeling. Recently, LSTM networks have also become popular for designing AI-based Intrusion Detection Systems (IDS). However, its applicability in IDS is studied largely in the default settings as used in language models. Whereas security applications offer distinct conditions and hence warrant careful consideration while applying such recurrent networks. Therefore, we conducted one of the most exhaustive works on LSTM hyper-parameters for IDS and experimented with approx. 150 LSTM configurations to determine its hyper-parameters relative importance, interaction effects, and optimal selection approach for designing an IDS. We conducted multiple analyses of the results of these experiments and empirically controlled for the interaction effects of different hyper-parameters covariate levels. We found that for security applications, especially for designing an IDS, neither similar relative importance as applicable to language models is valid, nor is the standard linear method for hyper-parameter selection ideal. We ascertained that the interaction effect plays a crucial role in determining the relative importance of hyper-parameters. We also discovered that after controlling for the interaction effect, the correct relative importance for LSTMs for an IDS is batch-size, followed by dropout ratio and padding. The findings are significant because when LSTM was first used for language models, the focus had mostly been on increasing the number of layers to enhance performance.