Cost-Effective Malware Detection as a Service over Serverless Cloud Using Deep Reinforcement Learning

The current trends of cloud computing in general, and serverless computing in particular, affect multiple aspects of organizational activity. Organizations of all sizes are transitioning parts of their operations off-premise in order to reduce costs and scale their operations more efficiently. The field of network security is no exception, with many organizations taking advantage of the distributed and scalable cloud environment. Since the charging model for serverless computing is "pay as you go" (i.e., payment per action), a reduction in the number of required computations translates into significant cost savings. This understanding is also relevant to the field of malware detection, where organizations often deploy multiple types of detectors to increase detection accuracy. In this study, we utilize deep reinforcement learning to reduce computational costs in the cloud by selectively querying only a subset of available detectors. We demonstrate that our approach is not only effective both for on-premise and cloud-based computing architectures, but that applying it to serverless computing can reduce costs by an order of magnitude while maintaining near-optimal performance.