Abstract
The rapid expansion of the Internet of Things (IoT) has intensified security concerns. Many IoT devices operate with limited computational resources and inadequate built-in protection. This makes them vulnerable to malware attacks such as Distributed Denial-of-Service (DDoS), botnets, and ransomware. Traditional signature-based detection techniques struggle to identify evolving and previously unseen threats, highlighting the need for intelligent detection mechanisms. This study proposes a Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) model for effective IoT malware detection. The CNN component extracts spatial features from network traffic, including packet-level and flow-based characteristics. The LSTM component captures temporal dependencies and sequential attack patterns. By integrating spatial and temporal learning, the hybrid architecture enhances detection capability for both known and zero-day attacks. Experimental results demonstrate superior performance compared to standalone CNN and LSTM models, achieving 99.92% accuracy, precision, recall, and F1-score, with a ROC-AUC of 0.999703.
References
AbdelBasset, M., Hawash, H., Sallam, K. M., Elgendi, I., Munasinghe, K., and Jamalipour, A. (2023). Efficient and lightweight convolutional networks for IoT malware detection: A federated learning approach. IEEE Internet of Things Journal, 10(8), 7164–7173.
Akhtar, M. S., and Feng, T. (2022). Detection of malware by deep learning as CNN–LSTM machine learning techniques in real time. Symmetry, 14(11), Article 2308.
Al-Fawa’reh, M., Abu-Khalaf, J., Szewczyk, P., and Kang, J. J. (2024). MalBoT-DRL: Malware botnet detection using deep reinforcement learning in IoT networks. IEEE Internet of Things Journal, 11(6), 9610–9629.
Ali, S., Abusabha, O., Ali, F., Imran, M., and Abuhmed, T. (2023). Effective multitask deep learning for IoT malware detection and identification using behavioral traffic analysis. IEEE Transactions on Network and Service Management, 20(2), 1199–1209.
Alimi, K. O. A., Ouahada, K., Abu-Mahfouz, A. M., Rimer, S., and Alimi, O. A. (2022). Refined LSTM based intrusion detection for denial-of-service attack in Internet of Things. Journal of Sensor and Actuator Networks, 11(3).
Almazroi, A. A., and Ayub, N. (2023). Enhancing smart IoT malware detection: A GhostNet-based hybrid approach. Systems, 11(11), Article 547.
Alomari, E. S., Nuiaa, R. R., Alyasseri, Z. A. A., Mohammed, H. J., Sani, N. S., Esa, M. I., and Musawi, B. A. (2023). Malware detection using deep learning and correlation-based feature selection. Symmetry, 15(1), Article 123.
Anandhi, V., Vinod, P., and Menon, V. G. (2024). Malware visualization and detection using DenseNets. Personal and Ubiquitous Computing, 28(1), 153–169.
Baker del Aguila, R., Pérez, C. D. C., Silva-Trujillo, A. G., Cuevas-Tello, J. C., and Nunez-Varela, J. (2024). Static malware analysis using low-parameter machine learning models. Computers, 13(3), Article 59.
Banaamah, A. M., and Ahmad, I. (2022). Intrusion detection in IoT using deep learning. Sensors, 22(21), Article 8417.
Chaganti, R., Suliman, W., Ravi, V., and Dua, A. (2023). Deep learning approach for SDN-enabled intrusion detection system in IoT networks. Information, 14(1), Article 41.
Deevi, D. P. (2020). Real-time malware detection via adaptive gradient support vector regression combined with LSTM and hidden Markov models. Science and Technology, 5(4).
Dib, M., Torabi, S., Bou-Harb, E., and Assi, C. (2021). A multi-dimensional deep learning framework for IoT malware classification and family attribution. IEEE Transactions on Network and Service Management, 18(2), 1165–1177.
El-Ghamry, A., Gaber, T., Mohammed, K. K., and Hassanien, A. E. (2023). Optimized and efficient image-based IoT malware detection method. Electronics, 12(3), Article 708.
Fernando, D. W., Komninos, N., and Chen, T. (2020). A study on the evolution of ransomware detection using machine learning and deep learning techniques. IoT, 1(2), 551–604.
Gyamfi, N. K., Goranin, N., Ceponis, D., and Èenys, H. A. (2023). Automated system-level malware detection using machine learning: A comprehensive review. Applied Sciences, 13(21), Article 11908.
Hamza, A. A., Halim, I. T. A., Sobh, M. A., and Bahaa-Eldin, A. M. (2022). HSAS-MD analyzer: A hybrid security analysis system using model-checking technique and deep learning for malware detection in IoT apps. Sensors, 22(3), Article 1079.
Hussain, S. S., Razak, M. F. A., and Firdaus, A. (2024). Deep learning based hybrid analysis of malware detection and classification: A recent review. Journal of Cyber Security and Mobility, 13(1), 91–134.
IoT-23_preprocessed dataset. (2023). Kaggle.
Kim, H.-M., and Lee, K.-H. (2022). IIoT malware detection using edge computing and deep learning for cybersecurity in smart factories. Applied Sciences, 12(15), Article 7679.
Kim, J., Shim, M., Hong, S., Shin, Y., and Choi, E. (2020). Intelligent detection of IoT botnets using machine learning and deep learning. Applied Sciences, 10(19), Article 7009.
Krzysztoń, E., Rojek, I., and Mikołajewski, D. (2024). A comparative analysis of anomaly detection methods in IoT networks: An experimental study. Applied Sciences, 14(24), Article 11545.
Pai, V., Pai, B. H. K., Sudhiksha, G. S., Kamath, V., Varsha, K., and Manjunatha, S. (2025). Systematic approach for malware detection in IoT devices: Enhancing security and performance. International Journal of Computational Intelligence Systems, 18(1), Article 196.
Saied, M., Guirguis, S., and Madbouly, M. (2023). A comparative study of using boosting-based machine learning algorithms for IoT network intrusion detection. International Journal of Computational Intelligence Systems, 16(1), Article 177.
Shafin, S. S., Karmakar, G., and Mareels, I. (2023). Obfuscated memory malware detection in resource-constrained IoT devices for smart city applications. Sensors, 23(11), Article 5348.
Shi, T., McCann, R. A., Huang, Y., Wang, W., and Kong, J. (2024). Malware detection for Internet of Things using one-class classification. Sensors, 24(13), Article 4122.
Vasan, D., Alazab, M., Venkatraman, S., Akram, J., and Qin, Z. (2020). MTHAEL: Cross-architecture IoT malware detection based on neural network advanced ensemble learning. IEEE Transactions on Computers, 69(11), 1654–1667.
Wazzan, M., Algazzawi, D., Albeshri, A., Hasan, S., Rabie, O., and Asghar, M. Z. (2022). Cross deep learning method for effectively detecting the propagation of IoT botnet. Sensors, 22(10), Article 3895.
Woźniak, M., Siłka, J., Wieczorek, M., and Alrashoud, M. (2021). Recurrent neural network model for IoT and networking malware threat detection. IEEE Transactions on Industrial Informatics, 17(8), 5583–5594.
M. Abomhara and G. M. Køien, “Cyber Security and the Internet of Things: Vulnerabilities, Threats, Intruders and Attacks,” JCSANDM, vol. 4, no. 1, pp. 65–88, May 2015.
S. Mocanu and J.-M. Thiriet, “Real-Time Performance and Security of IEC 61850 Process Bus Communications,” JCSANDM, vol. 10, no. 2, pp. 305–346, Apr. 2021.
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Copyright (c) 2026 Journal of Cyber Security and Mobility