# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 3 Edge Computing and Deep Learning-Based Malware Detection Method  
### Deep Learning for Malware Detection  
Most malware attacks are variants of previously known cyberattacks, and there is a limit to the ability of a few experts to respond to the increasing range of variants. For handling malware variants, similarity-based machine learning methods using API call sequences [58], as well as Support Vector Machine (SVM) [59] and other various machine learning models (Decision Tree (DT) [60,61], Extreme Learning Machine (ELM) [62], k-Nearest Neighbors [63], Logistic Regression [64], Random Forest (RF) [65], Naive Bayes [66], Neural Networks [67], and Multi-Layer Perception (MLP) [68]) have been presented [8]. However, because the performance of such machine learning-based malware detection methods largely depended on the extracted function, sophisticated function extraction was crucial. A local neighborhood binary pattern (LNBP) that extracts feature vectors using all neighborhoods to classify malicious codes has been proposed [69]. This feature extraction is performed manually by experts, which is a difficult task and is both time-consuming and requires extensive domain knowledge [70]. As such, traditional machine learning systems are not highly accurate in recognizing new variants as humans cannot directly create functions (patterns) and extract abstract features to distinguish new attacks or mutations.  
Deep learning, an improvement model of machine learning (neural network), is a method used for feature extraction and classification that is well known in the areas of image recognition and data processing. Deep learning can predict or classify malware more accurately with improved task performance than machine learning by using multiple processing layers to extract complex patterns from raw data and analyze massive traffic volumes [71,72]. In addition, as deep learning is automatically designed by the algorithm itself rather than a manually designed feature extractor, as shown in Figure 4, it allows automatic extraction of complex and high-dimensional features without the need for coding by humans [73]. Even for small changes or modifications, such as new variants, it is possible to accurately classify malicious codes by learning the true properties (attack patterns) of the data.  
An image similarity-based feature extraction method that classifies malware by learning similar features with similar structures by exploiting the advantages of deep learning has been proposed [74, 75, 76]. An executable file of malware is represented as matrices of hexadecimal or binary strings and can be converted into anything conceivable as images. To create new malware, malware authors typically add or change code from previous malware.  
Figure 4: Comparison of function extraction methods.  
This makes it easy to visualize small additions or changes in various sections of the file structure when viewed as an image. [PERSON] et al. [76] demonstrated that it is possible to detect malicious codes more accurately by analyzing the texture characteristics of images than the existing malicious code analysis techniques. An image-based texture analysis that extracted the global image descriptors (GIST) characteristics of the malicious code image and classified the malicious code by K-Nearest Neighbors (KNN) was implemented. As such, malware classification using image processing technology in this way can be applied regardless of the operating system. As it does not require disassembly or separate code execution, it is faster than static and dynamic analysis and has the advantage of being able to process obfuscation technologies such as encryption and packed malware [77]. Most of the malware detection approaches using deep learning are based on supervised learning.