A multimodal feature fusion-driven framework for IoT malware classification

Abstract

Rapid growth of Internet of Things (IoT) devices contributed to a significant surge in malware-based cyber-attacks. Traditional malware detection methods often struggle to adapt to the heterogeneous nature of IoT devices and the rapidly evolving threat landscape. This work presents a novel multimodal IoT malware classification framework, IoTMalFusion, for efficient malware classification and family attribution. IoTMalFusion uses a lightweight custom DenseNet model to extract visual features from RGB images and a Skip-Gram based Word2Vec model to obtain opcode sequence embeddings from real-world malware binaries. After an extensive pre-processing stage, it then integrates image-derived features with the opcode feature set to construct a final fused feature vector. The fusion stage employs a stacked ensemble classifier that combines Support Vector Machine (SVM) and XGBoost to enable accurate, robust, and computationally efficient malware family classification. The exhaustive experimental evaluations on IoTPOT dataset demonstrate a remarkable performance of IoTMalFusion in IoT malware family classification, attaining an exceptional 99.64% accuracy and an outstanding 99.86% F1-score. Further, the results highlight that IoTMalFusion can outperform baseline models and current state-of-the-art methods through a comprehensive comparative analysis.