Hybrid Deep- Learning Approach with Transformer Integration for Unknown Malware Detection in IoT Environments
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
The extensive use of Internet of Things (IoT) devices in every aspect of human life presents severe securitythreats due to their increased attack surfaces. The presence of unknown or novel malware is extremely difficult to identifyusing the conventional signature-based mechanisms. This paper proposes a hybrid malware detection framework that integratesdeep learning with a real attention mechanism. An attention-enhanced autoencoder is employed to learn featuresaliency and reconstruct benign behavior, with reconstruction error serving as a key anomaly indicator. The accuracy of malwaredetection is improved by combining the contextual dependencies of the transformer-based encoder, the cosine similarityin the autoencoder's latent space, and the anomaly scores from Isolation Forest. The individual anomaly scores from thesecomponents are integrated to capture the varied outlier behaviors. A dynamic, Receiver Operating Characteristic optimizedthresholding mechanism is used to fine-tune the decision boundaries for high sensitivity and specificity. Experiments on theN-BaIoT and UNSW-NB15 dataset yielded an accuracy of 99-96% and an F1-score of 0.99-0.96 on Mirai and Bashlite malwareand on DoS and back door attacks with an inference time of 13-20s. These results demonstrated the effectiveness ofthe framework in detecting zero-day threats with minimal memory and processing overhead.
Abstract
The extensive use of Internet of Things (IoT) devices in every aspect of human life presents severe securitythreats due to their increased attack surfaces. The presence of unknown or novel malware is extremely difficult to identifyusing the conventional signature-based mechanisms. This paper proposes a hybrid malware detection framework that integratesdeep learning with a real attention mechanism. An attention-enhanced autoencoder is employed to learn featuresaliency and reconstruct benign behavior, with reconstruction error serving as a key anomaly indicator. The accuracy of malwaredetection is improved by combining the contextual dependencies of the transformer-based encoder, the cosine similarityin the autoencoder's latent space, and the anomaly scores from Isolation Forest. The individual anomaly scores from thesecomponents are integrated to capture the varied outlier behaviors. A dynamic, Receiver Operating Characteristic optimizedthresholding mechanism is used to fine-tune the decision boundaries for high sensitivity and specificity. Experiments on theN-BaIoT and UNSW-NB15 dataset yielded an accuracy of 99-96% and an F1-score of 0.99-0.96 on Mirai and Bashlite malwareand on DoS and back door attacks with an inference time of 13-20s. These results demonstrated the effectiveness ofthe framework in detecting zero-day threats with minimal memory and processing overhead.