LSTM Hyper-Parameter Selection for Malware Detection: Interaction
  Effects and Hierarchical Selection Approach
  Long-Short-Term-Memory (LSTM) networks have shown great promise in artificial
intelligence (AI) based language modeling. Recently, LSTM networks have also
become popular for designing AI-based Intrusion Detection Systems (IDS).
However, its applicability in IDS is studied largely in the default settings as
used in language models. Whereas security applications offer distinct
conditions and hence warrant careful consideration while applying such
recurrent networks. Therefore, we conducted one of the most exhaustive works on
LSTM hyper-parameters for IDS and experimented with approx. 150 LSTM
configurations to determine its hyper-parameters relative importance,
interaction effects, and optimal selection approach for designing an IDS. We
conducted multiple analyses of the results of these experiments and empirically
controlled for the interaction effects of different hyper-parameters covariate
levels. We found that for security applications, especially for designing an
IDS, neither similar relative importance as applicable to language models is
valid, nor is the standard linear method for hyper-parameter selection ideal.
We ascertained that the interaction effect plays a crucial role in determining
the relative importance of hyper-parameters. We also discovered that after
controlling for the interaction effect, the correct relative importance for
LSTMs for an IDS is batch-size, followed by dropout ratio and padding. The
findings are significant because when LSTM was first used for language models,
the focus had mostly been on increasing the number of layers to enhance
performance.
