Malware Network Traffic Classification on the Edge
Eric Chen, Alexander Perez-Pons · 2022 IEEE 19th International Conference on Mobile Ad Hoc and Smart Systems (MASS) · 2022
Network traffic classification is a part of many cybersecurity applications, such as intrusion detection systems and anomaly detection. Currently, many cybersecurity tasks employ a cloud computing architecture, including network traffic classification. However, this architecture may not be able to meet the latency demands in the future with the ever-increasing number of network data. Therefore, we propose to perform network traffic classification utilizing edge computing and applying tiny machine learning to classify closer to the data source. Our approach uses TensorFlow Lite to convert a traditional convolutional neural network into a tiny machine learning model that runs on an edge device. In order to assess the impact of edge classification, we ran simulations on the edge device and compared these results to a cloud-computing counterpart. We determined that the edge device was faster and had reduced latency compared to a cloud computing alternative, with a negligible reduction in accuracy and decrease in model size throughout all experiments.