LSTM-Based Malware Classification using Bytecode and Opcode Features for IoT Security

This study proposes a deep learning approach for malware
classification, utilizing both byte-level and opcode features. The
dataset comprises the byte files and opcode sequences, which are
preprocessing, features are extracted, and integration with
corresponding class labels. Byte files are analysed for size
distribution, address removal, and unigram bag-of-words
representation, while opcode features are extracted separately.
SMOTE is used to tackle the challenge of class imbalance An LSTM
neural network is employed to categorized the malware into distinct
families by using the extracted features. This model is designed to
differentiate between various malware families, including Ramnit
(Trojan), Lollipop (Adware), Vundo (Trojan), Simda (Backdoor).
Finally, This model is trained with categorical cross entropy loss
and optimized using the Adam optimizer is utilized to enhanced and
improved the accuracy across the different malware types. The
proposed methodology achieves a test accuracy of 86.5%, delivers
with strong classification results as precision (87.8%), recall
(91.2%), and F1-score (85.0%). The confusion matrix analysis
indicates minimal misclassifications among malware families,
demonstrating the model’s robustness. Performance metrics used to
validate and confirm the model's effectiveness in generalization,
demonstrated y analyzing training and validation accuracy and loss
curves showing the stable convergence.