Embedding Dropout for Resource-Limited IoT Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware detection schemes are resource-intensive and challenging for IoT devices due to their limited hardware and energy capabilities, making them unsuited for sophisticated detection methods.
Innovation Solution
Implementing an aggressive embedding dropout operation in an artificial neural network-based malware detection service that reduces the number of embeddings used for malware detection, utilizing a feature importance operation to identify the most descriptive embeddings and ignoring lesser-important ones, thereby simplifying the detection process and conserving processor, memory, and battery resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple embeddings are generated and used in the classifier, then malware detection accuracy is improved, but processor, memory, and battery resources are excessively consumed
Solution Approach 1:
The patent extracts and retains only the most important embedding features identified through feature importance analysis, discarding less critical embeddings. This selective extraction maintains detection accuracy while significantly reducing the computational burden and energy consumption on IoT devices.
Solution Approach 2:
The patent changes the parameter of embedding quantity from using all generated embeddings to using only a selected subset based on importance metrics. This parameter change optimizes the balance between detection accuracy and resource consumption by adjusting how many embeddings are processed.
2Measurement precision
If multiple embeddings are generated and used in the classifier, then malware detection accuracy is improved, but device complexity increases
Solution Approach 1:
The patent extracts only the essential embedding features that contribute most to detection accuracy, removing unnecessary complexity from the detection scheme. This simplification makes the system more suitable for IoT devices with limited computational capabilities.
Solution Approach 2:
The patent applies partial action by using only a subset of embeddings rather than all generated embeddings. This partial approach achieves sufficient detection accuracy without the excessive complexity of processing every possible embedding.
3Use of energy by moving object
If feature importance operation is performed to identify important embeddings, then resource consumption is reduced, but additional processing time is required
Solution Approach 1:
The feature importance analysis is performed as a preliminary action during the model training phase, not during real-time detection. This preliminary computation identifies which embeddings are most important, and these results are then reused during actual malware detection, reducing real-time processing requirements.
Solution Approach 2:
The patent creates a copy of the feature importance weights computed during training, and uses these pre-computed weights to guide embedding selection during inference. This copying approach avoids re-computing feature importance during each detection operation, saving time.
Data Source
AI summary
Malware is detected using an embedding-based machine learning model. The model generates embeddings using byte n-grams. A feature importance operation reveals that only a subset of the embeddings is required to detect malware. In some cases, even a single embedding is adequate and retains 99% detection capabilities. An aggressive embedding dropout operation is implemented that ignores lesser-important embeddings. Because perhaps only one, or a few, embeddings need be determined, malware detection is greatly simplified. Malware detection is greatly simplified and need not calculate full-sized embeddings. A malware detection service runs quicker, and just as capably, while consuming less resources.