Machine Learning-Based Malware Detection in a Production Setting
摘要
Machine Learning-based approaches for detection of malware files or execution of malware have been experiencing growing attention both in academia and in the security industry. With an ever-increasing flood of new threats, the promise of these approaches is to establish a more proactive posture as compared to other methods such as signatures and heuristics. However, operating Machine Learning systems in a production environment is not a trivial task and often overlooked in academic works. In this work, we are giving an overview of the additional requirements, constraints, and complications stemming from running a Machine Learning model as part of such a larger system in an industry setting. This includes model-specific requirements, such as target false-positive rates, corpus size, and corpus diversity, and system-specific needs, such as false-positive/false-negative mitigation, robustness and cost of the model generation process, establishment of feedback mechanisms, deployment considerations, and implementation constraints. Lastly, we touch on common compliance and contractual considerations.