Minimum Viable Malware-image Resolution for ESP32-S3 Edge Triage

Abstract

—Image-based malware classification can achieve high accuracy on workstation-class hardware; however, the suitability of such methods for Internet of Things (IoT) security depends on whether they can produce useful representations that can fit within the physical limitations (memory, latency and energy consumption) of microcontroller-class devices. Therefore, this work investigates a narrower problem than general malware detection: what is the lowest resolution that malware can have while still being useful for edge triage given the Espressif Systems ESP32-S3 Series System-on-Chip (ESP32-S3) microcontroller? A convolutional neural network was trained and converted using TensorFlow Lite to four different input sizes, and evaluated on-device using local test inputs to keep inference results clear of overhead from network transfer. Subsequent controlled re-runs of the same 9.334 usable maling images have shown that gives a family classification accuracy of 97.30% on a test split of 1.410 samples, which is only slightly lower than the 97.45% family classification accuracy of. When performing a 100-sample serial repeat of an ESP32-S3 for inference, mean live latency was measured at as being 24.23 s and as being 5.68 s, with lower model storage and lower maximum Pseudo Static Random Access Memory (PSRAM) use with the lower resolution model. Results suggest that for periodic edge triage is the minimum useful resolution based on this experimental setup; however, a separate benign/malware detection feasibility study was conducted as an extension to address the practical aspect of the detection scope for future research