# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 3 Edge Computing and Deep Learning-Based Malware Detection Method
### Deep Learning for Malware Detection in Smart Factory  
However, in distributed IIoT devices with limited resources, such as smart factories, the complexity and high computational overhead of deep learning becomes a problem. Because neural network training is the most time-consuming and laborious part of the process, handling this directly on IIoT devices in smart factories is problematic. [PERSON] et al. [78] proposed a lightweight DNN-based NIDS (Realguard) that operates directly on resource-constrained IIoT edge gateways to protect local IIoT devices within the network. The labeled CIC-IDS-2017 dataset was used for model training and testing, with the proposed system exhibiting a high accuracy of 99.57%, on average. As labeled sample data were required to train the malware detection model, building such labeled data was difficult. It was also difficult to detect newly emerged malware as it had different characteristics from the original sample used for training. To address this, [PERSON] et al. [79] proposed a malware detection method based on unsupervised domain adaptation (UDA) by jointly linking the distribution of known and unknown malware.  
The recurrent neural network (RNN) has a problem in that context information cannot be continuously learned over a long period owing to gradient loss. Conversely, long short-term memory (LSTM), an extended implementation of RNN, can keep information about previous states and is used when long/short time dependence (data from the current time point is more likely to be related to a previous point in time or in the past) is required [80]. As LSTM can recognize repetition of attack patterns in long packet sequences, it can be applied to the learning of functions and patterns of network data to classify them as positive or attack in malware detection, and it is effective for training on unstructured datasets such as IIoT [81]. In the approach suggested by [PERSON] et al. [82], LSTM was used for detecting outliers of attacks in IIoT. This method used the stacked LSTM-NN, a variant of RNN that can solve time-dependent data processing and gradient loss problems, and the LSTM-Gaussian Bayes method to classify the attack, with the Gaussian Bayes model using the predicted results from the LSTM.  
Malware detection using CNN in the smart factory field automatically utilizes two preprocessing steps, feature extraction and feature selection, and uses sparse interaction and parameter sharing to reduce data parameters. Several studies have used CNNs for IIoT security [83; 84; 85; 86]. [PERSON] et al. [87] designed and implemented a deep learning-based intrusion detection solution for a SCADA industrial control system. The intrusion detection method used a CNN to characterize the behavioral patterns of temporal network traffic of SCADA hosts, classifying and assigning abnormal patterns to labels (e.g., normal/abnormal), allowing SCADA operators to check these classified labels and take appropriate countermeasures.  
In a smart factory environment, it is important to detect and mitigate cyberattacks on ICSs that can disrupt physical industrial processes and cause potential injuries to workers. [PERSON] et al. [88] proposed SafeMan, an integrated management framework for monitoring network traffic, workspace, and worker activity based on edge computing to achieve low latency and fast deployment of applications. Three industrial scenario cases were introduced and compared, and for validation of the proposed SafeMan, the runtime performance was measured based on machine learning and deep learning using ModbusTCP and Electra, an open industrial dataset generated by S7 Comm. As a result of the measurement, 217 feature vectors were inspected per second through Electra.