LSTM-Based Malware Classification using Bytecode and Opcode Features for IoT Security

This study proposes a deep learning approach for malware classification, utilizing both byte-level and opcode features. The dataset comprises the byte files and opcode sequences, which are preprocessing, features are extracted, and integration with corresponding class labels. Byte files are analysed for size distribution, address removal, and unigram bag-of-words representation, while opcode features are extracted separately. SMOTE is used to tackle the challenge of class imbalance An LSTM neural network is employed to categorized the malware into distinct families by using the extracted features. This model is designed to differentiate between various malware families, including Ramnit (Trojan), Lollipop (Adware), Vundo (Trojan), Simda (Backdoor). Finally, This model is trained with categorical cross entropy loss and optimized using the Adam optimizer is utilized to enhanced and improved the accuracy across the different malware types. The proposed methodology achieves a test accuracy of 86.5%, delivers with strong classification results as precision (87.8%), recall (91.2%), and F1-score (85.0%). The confusion matrix analysis indicates minimal misclassifications among malware families, demonstrating the model’s robustness. Performance metrics used to validate and confirm the model's effectiveness in generalization, demonstrated y analyzing training and validation accuracy and loss curves showing the stable convergence.