Lightweight AI-Based Cross-Architecture Detection of IoT Malware Using Opcode and System Call Analysis

The Internet of Things (IoT) is expanding rapidly across consumer, industrial, and infrastructure domains. As malware targeting these resource-constrained devices becomes increasingly sophisticated, new approaches to detection are required. This paper presents a comparative study of three analysis techniques for IoT malware detection: static opcode analysis, dynamic opcode tracing, and dynamic system call analysis. Experiments were conducted across four widely used architectures, x86, ARM, MIPS, and MIPSEL-using code emulation. Feature vectors were generated from both static disassembly and runtime execution traces, and evaluated using Random Forest classifiers. Results show that dynamic opcode analysis consistently outperforms static analysis across all architectures, achieving accuracy up to 100%. These findings demonstrate the potential for fast, lightweight, and architecture-aware malware detection systems suitable for real-world IoT deployments. This work presents two novel contributions. First, the first dynamic opcode analysis of MIPS and MIPSEL platforms for malware detection. Second, the first comprehensive comparison of static opcode analysis, dynamic opcode tracing, and dynamic system call monitoring for IoT malware detection across multiple architectures, laying the groundwork for future research into cross platform detection techniques.