Optimal Data Sample Length for System Call Traces for Malware Detection in an IoT Ecosystem

As with many Machine Learning (ML) models, parameter tuning is one of the most important steps in the training phase. In the case of IoT malware detection, many parameters are chosen through experimentation and experience with the specific data collected. One important parameter is the size of the time window used to segment the observed data. Since each IoT device, and by extension, the malware infecting it, all have different behavioral profiles, it can be difficult to select a good time window size with any degree of certainty without first going through a trial-and-error period. This work describes how important this one parameter can be to an effective ML model using kernel level system call data, which comprises a couple of types of IoT devices as well as a couple of types of malware, each within the same IoT Ecosystem framework. To our knowledge, there has not been extensive work done in this field. We show that finding an optimal data sample length can mean the difference between an efficacious and an unusable malware detector.