Module owlyshield_ransom::predictions::prediction_malware

The prediction uses a RNN model (LSTM) trained on a CSV files created by cargo run --features replay. We use TensorflowLite with the windows dll.

This allows us to make predictions locally, without having to install Tensorflow, which is an heavy framework to install and to start. This comes at a price: some interesting features available with Tensorflow and Keras are not supported by TfLite. Our main issue is that owlyshield predict can generate very long predictions sequences that could be handle by stateful lstm with trucated backpropagation through time (tbtt). But stateful lstm is not possible with TfLite and the state has to be manually propagated between epochs. That’s why we limit the sequence length, capped to crate::predictions::prediction::PREDMTRXROWS. See module crate::predictions::prediction::input_tensors for details.

Structs

TfLiteMalware

A record to describe a tflite model

Statics

MEANS

Features means vector, used by Standard Scaling.

MODEL

The .tflite (converted from Tensorflow/Keras) model is included as a static variable.

STDVS

Features standard deviations vector used by Standard Scaling.