# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 3 Edge Computing and Deep Learning-Based Malware Detection Method
### Edge Computing and Deep Learning-Based Malware Detection System  
The large-scale use of IIoT in industrial control systems in smart factory, hardware resource constraints, and the global accessibility of IIoT systems make them a very desirable cyberattack target for attackers. The disadvantages of traditional machine learning in cyberattack detection are its lack of automatic feature engineering, low detection rates, and inability to detect slight mutations in conventional attacks. These limitations can be overcome by adopting deep learning [89]. Deep learning can find complicated features by automatically mapping inputs to outputs without the manual intervention of specialists by constructing high-level representations of features. It can also benefit from automatic hierarchical feature learning from raw data, which better depicts underlying network traffic patterns and improves model accuracy for unknown or mutated threats. However, deep learning models require huge computational resources for training owing to their many parameters and repeated epochs. Therefore, the high computational overhead of deep learning is a problem in IIoT devices with limited hardware resources. To solve this problem, deep learning operations must be performed by offloading them to other devices with high (sufficient) computational power. In other words, the model should learn parameters from other devices with high-performance computing power and then transmit (distribute) to the edge device where the model is to be operated. If a large number of users make an offloading request to one central cloud server at this time, the response speed may decrease and the expected performance may not be obtained. For this reason, instead of one central cloud server, edge computing with several servers geographically distributed is used. There is currently no standard for distributed edge computing architectures for IIoT deep learning. In the literature, various architectures have been proposed for distributed edge computing, such as a two-layer architecture consisting of edge and cloud layers [19]; three-layer architectures consisting of edge, network, and application layers or IoT, fog, and cloud layers [89; 90]; and a four-layer architecture consisting of IoT, network, fog, and cloud layers [91]. This paper proposes a three-layer architecture comprising edge device, edge, and cloud layers. Specifically, the deep learning model is trained in the local domain on edge servers in the edge layer. A large-capacity cloud server in the cloud layer is then used to train the global integrated deep learning model of each edge server. Figure 5 shows the edge computing and deep learning-based IIoT malware detection system architecture proposed in this paper. The main functions of each layer are presented below. _Edge device layer:_ This layer consists of edge IIoT sensor terminals that are in direct contact with the data to be collected. The edge device is an embedded device (e.g., an IIoT sensor) connected to the end of the network for information collection and processing, such as a sensor in a smart factory. Most edge IIoT devices belonging to this layer have limited resources, which limits the use of detection or large-scale deep learning models. _Edge layer:_ This layer consists of several edge devices (e.g., network Router/Gateway) and edge servers that perform detection using deep learning models on the local edge network. Here, the edge device has enough computational power to quickly perform detection, and the edge server can train a deep learning model by processing local area (edge network) data, but the computational power is insufficient to train or update a global integrated deep learning model by processing large amounts of data. As such, edge computing devices (e.g., edge servers) include a model training engine. After creating a classification or prediction model through this, inference (malware detection) is performed according to the prediction or judgment model by sending the model to the edge device.