{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,7]],"date-time":"2026-04-07T16:23:53Z","timestamp":1775579033019,"version":"3.50.1"},"reference-count":48,"publisher":"MDPI AG","issue":"23","license":[{"start":{"date-parts":[[2022,11,29]],"date-time":"2022-11-29T00:00:00Z","timestamp":1669680000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Princess Nourah bint Abdulrahman University Researchers Supporting Project","award":["PNURSP2022R51"],"award-info":[{"award-number":["PNURSP2022R51"]}]},{"name":"Princess Nourah bint Abdulrahman University, Riyadh, Saudi Arabia","award":["PNURSP2022R51"],"award-info":[{"award-number":["PNURSP2022R51"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Internet of Things (IoT) devices usage is increasing exponentially with the spread of the internet. With the increasing capacity of data on IoT devices, these devices are becoming venerable to malware attacks; therefore, malware detection becomes an important issue in IoT devices. An effective, reliable, and time-efficient mechanism is required for the identification of sophisticated malware. Researchers have proposed multiple methods for malware detection in recent years, however, accurate detection remains a challenge. We propose a deep learning-based ensemble classification method for the detection of malware in IoT devices. It uses a three steps approach; in the first step, data is preprocessed using scaling, normalization, and de-noising, whereas in the second step, features are selected and one hot encoding is applied followed by the ensemble classifier based on CNN and LSTM outputs for detection of malware. We have compared results with the state-of-the-art methods and our proposed method outperforms the existing methods on standard datasets with an average accuracy of 99.5%.<\/jats:p>","DOI":"10.3390\/s22239305","type":"journal-article","created":{"date-parts":[[2022,11,30]],"date-time":"2022-11-30T08:46:41Z","timestamp":1669798001000},"page":"9305","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":55,"title":["Malware Detection in Internet of Things (IoT) Devices Using Deep Learning"],"prefix":"10.3390","volume":"22","author":[{"given":"Sharjeel","family":"Riaz","sequence":"first","affiliation":[{"name":"Department of Computer Science, Shaheed Zulfikar Ali Bhutto Institute of Science and Technology, Islamabad Campus, Islamabad 44000, Pakistan"}]},{"given":"Shahzad","family":"Latif","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Shaheed Zulfikar Ali Bhutto Institute of Science and Technology, Islamabad Campus, Islamabad 44000, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0504-3558","authenticated-orcid":false,"given":"Syed Muhammad","family":"Usman","sequence":"additional","affiliation":[{"name":"Department of Creative Technologies, Faculty of Computing and Artificial Intelligence, Air University, Islamabad 44000, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5406-0389","authenticated-orcid":false,"given":"Syed Sajid","family":"Ullah","sequence":"additional","affiliation":[{"name":"Department of Information and Communication Technology, University of Agder (UiA), N-4898 Grimstad, Norway"}]},{"given":"Abeer D.","family":"Algarni","sequence":"additional","affiliation":[{"name":"Department of Information Technology, College of Computer and Information Sciences, Princess Nourah bint Abdulrahman University, P.O. Box 84428, Riyadh 11671, Saudi Arabia"}]},{"given":"Amanullah","family":"Yasin","sequence":"additional","affiliation":[{"name":"Department of Creative Technologies, Faculty of Computing and Artificial Intelligence, Air University, Islamabad 44000, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2891-7844","authenticated-orcid":false,"given":"Aamir","family":"Anwar","sequence":"additional","affiliation":[{"name":"School of Computing and Engineering, The University of West London, London W5 5RF, UK"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2571-1848","authenticated-orcid":false,"given":"Hela","family":"Elmannai","sequence":"additional","affiliation":[{"name":"Department of Information Technology, College of Computer and Information Sciences, Princess Nourah bint Abdulrahman University, P.O. Box 84428, Riyadh 11671, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1523-1330","authenticated-orcid":false,"given":"Saddam","family":"Hussain","sequence":"additional","affiliation":[{"name":"School of Digital Science, Universiti Brunei Darussalam, Jalan Tungku Link, Gadong BE1410, Brunei"}]}],"member":"1968","published-online":{"date-parts":[[2022,11,29]]},"reference":[{"key":"ref_1","unstructured":"Mendez, D.M., Papapanagiotou, I., and Yang, B. (2017). Internet of things: Survey on security and privacy. arXiv."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"01053","DOI":"10.1051\/matecconf\/201815901053","article-title":"An integration of pso-based feature selection and random forest for anomaly detection in iot network","volume":"159","author":"Tama","year":"2018","journal-title":"MATEC Web Conf."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"102154","DOI":"10.1016\/j.adhoc.2020.102154","article-title":"Malware detection in industrial internet of things based on hybrid image visualization and deep learning model","volume":"105","author":"Naeem","year":"2020","journal-title":"Ad Hoc Netw."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"102591","DOI":"10.1016\/j.adhoc.2021.102591","article-title":"Generative adversarial network to detect unseen internet of things malware","volume":"122","author":"Moti","year":"2021","journal-title":"Ad Hoc Netw."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"105","DOI":"10.1016\/j.eij.2020.05.003","article-title":"Internet of things and ransomware: Evolution, mitigation and prevention","volume":"22","author":"Humayun","year":"2021","journal-title":"Egypt. Inform. J."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1109\/MCOM.2018.1700621","article-title":"A multi-level DDoS mitigation framework for the industrial Internet of Things","volume":"56","author":"Yan","year":"2018","journal-title":"IEEE Commun. Mag."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"334","DOI":"10.1016\/j.future.2021.06.029","article-title":"MCFT-CNN: Malware classification with fine-tune convolution neural networks using traditional and transfer learning in Internet of Things","volume":"125","author":"Kumar","year":"2021","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"102779","DOI":"10.1016\/j.cose.2022.102779","article-title":"Deep Learning based Cross Architecture Internet of Things malware Detection and Classification","volume":"120","author":"Chaganti","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Madan, S., Sofat, S., and Bansal, D. (2022). Tools and Techniques for Collection and Analysis of Internet-of-Things malware: A systematic state-of-art review. J. King Saud Univ.-Comput. Inf. Sci.","DOI":"10.1016\/j.jksuci.2021.12.016"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"147","DOI":"10.1016\/j.comnet.2019.01.023","article-title":"Internet of Things: A survey on machine learning-based intrusion detection approaches","volume":"151","author":"Papa","year":"2019","journal-title":"Comput. Netw."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/MSP.2018.2825478","article-title":"IoT security techniques based on machine learning: How do IoT devices use AI to enhance security?","volume":"35","author":"Xiao","year":"2018","journal-title":"IEEE Signal Process. Mag."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"761","DOI":"10.1016\/j.future.2017.08.043","article-title":"Distributed attack detection scheme using deep learning approach for Internet of Things","volume":"82","author":"Diro","year":"2018","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"39998","DOI":"10.1109\/ACCESS.2020.2976866","article-title":"Epileptic seizures prediction using deep learning techniques","volume":"8","author":"Usman","year":"2020","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Yeo, M., Koo, Y., Yoon, Y., Hwang, T., Ryu, J., Song, J., and Park, C. (2018, January 10\u201312). Flow-based malware detection using convolutional neural network. Proceedings of the 2018 International Conference on Information Networking (ICOIN), Chiang Mai, Thailand.","DOI":"10.1109\/ICOIN.2018.8343255"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"2215852","DOI":"10.1155\/2022\/2215852","article-title":"A Deep Learning-Based Framework for Feature Extraction and Classification of Intrusion Detection in Networks","volume":"2022","author":"Naveed","year":"2022","journal-title":"Wirel. Commun. Mob. Comput."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Althubiti, S.A., Jones, E.M., and Roy, K. (2018, January 21\u201323). LSTM for anomaly-based network intrusion detection. Proceedings of the 2018 28th International Telecommunication Networks and Applications Conference (ITNAC), Sydney, NSW, Australia.","DOI":"10.1109\/ATNAC.2018.8615300"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.sysarc.2019.01.017","article-title":"Fuzzy pattern tree for edge malware detection and categorization in IoT","volume":"97","author":"Dovom","year":"2019","journal-title":"J. Syst. Archit."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"66","DOI":"10.1016\/j.asoc.2018.06.017","article-title":"Securing the operations in SCADA-IoT platform based industrial control system using ensemble of deep belief networks","volume":"71","author":"Huda","year":"2018","journal-title":"Appl. Soft Comput."},{"key":"ref_19","first-page":"25","article-title":"New Intrusion Detection System Based on Support Vector Domain Description with Information Gain Metric","volume":"20","author":"Jedra","year":"2018","journal-title":"Int. J. Netw. Secur."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Kaur, G. (2018, January 2\u20134). A novel distributed machine learning framework for semi-supervised detection of botnet attacks. Proceedings of the 2018 Eleventh International Conference on Contemporary Computing (IC3), Noida, India.","DOI":"10.1109\/IC3.2018.8530562"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"88","DOI":"10.1109\/TSUSC.2018.2809665","article-title":"Robust malware detection for internet of (battlefield) things devices using deep eigenspace learning","volume":"4","author":"Azmoodeh","year":"2018","journal-title":"IEEE Trans. Sustain. Comput."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"314","DOI":"10.1109\/TETC.2016.2633228","article-title":"A two-layer dimension reduction and two-tier classification model for anomaly-based intrusion detection in IoT backbone networks","volume":"7","author":"Pajouh","year":"2016","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Sharma, A., and Sahay, S.K. (2016). An effective approach for classification of advanced malware with high accuracy. arXiv.","DOI":"10.14257\/ijsia.2016.10.4.24"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"901","DOI":"10.1007\/s13198-017-0683-8","article-title":"Hybridization of K-means and firefly algorithm for intrusion detection system","volume":"9","author":"Kaur","year":"2018","journal-title":"Int. J. Syst. Assur. Eng. Manag."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Prokofiev, A.O., Smirnova, Y.S., and Surov, V.A. (February, January 29). A method to detect Internet of Things botnets. Proceedings of the 2018 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (EIConRus), Moscow and St. Petersburg, Russia.","DOI":"10.1109\/EIConRus.2018.8317041"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Zhou, Y., Han, M., Liu, L., He, J.S., and Wang, Y. (2018, January 15\u201319). Deep learning approach for cyberattack detection. Proceedings of the IEEE INFOCOM 2018-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Honolulu, HI, USA.","DOI":"10.1109\/INFCOMW.2018.8407032"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Zak, R., Raff, E., and Nicholas, C. (2017, January 11\u201314). What can N-grams learn for malware detection?. Proceedings of the 2017 12th International Conference on Malicious and Unwanted Software (MALWARE), Fajardo, PR, USA.","DOI":"10.1109\/MALWARE.2017.8323963"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1109\/TNSM.2020.2966951","article-title":"IoT-KEEPER: Detecting malicious IoT network activity using online traffic analysis at the edge","volume":"17","author":"Hafeez","year":"2020","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"4436","DOI":"10.1109\/TIA.2020.2971952","article-title":"A visualized botnet detection system based deep learning for the Internet of Things networks of smart cities","volume":"56","author":"Vinayakumar","year":"2020","journal-title":"IEEE Trans. Ind. Appl."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"6348","DOI":"10.1109\/JIOT.2020.2966778","article-title":"FDC: A secure federated deep learning mechanism for data collaborations in the Internet of Things","volume":"7","author":"Yin","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Nguyen, T.D., Marchal, S., Miettinen, M., Fereidooni, H., Asokan, N., and Sadeghi, A.R. (2019, January 7\u201310). D\u00cfoT: A federated self-learning anomaly detection system for IoT. Proceedings of the 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), Dallas, TX, USA.","DOI":"10.1109\/ICDCS.2019.00080"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"88","DOI":"10.1016\/j.future.2018.03.007","article-title":"A deep recurrent neural network based approach for internet of things malware threat hunting","volume":"85","author":"HaddadPajouh","year":"2018","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"21954","DOI":"10.1109\/ACCESS.2017.2762418","article-title":"A deep learning approach for intrusion detection using recurrent neural networks","volume":"5","author":"Yin","year":"2017","journal-title":"IEEE Access"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"e2039","DOI":"10.1002\/nem.2039","article-title":"Botnet detection based on network flow summary and deep learning","volume":"28","author":"Acarman","year":"2018","journal-title":"Int. J. Netw. Manag."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"312","DOI":"10.1016\/j.ins.2018.08.019","article-title":"Deep neural networks for bot detection","volume":"467","author":"Kudugunta","year":"2018","journal-title":"Inf. Sci."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"McDermott, C.D., Majdani, F., and Petrovski, A.V. (2018, January 8\u201313). Botnet detection in the internet of things using deep learning approaches. Proceedings of the 2018 International Joint Conference on Neural Networks (IJCNN), Rio de Janeiro, Brazil.","DOI":"10.1109\/IJCNN.2018.8489489"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"2742","DOI":"10.1109\/TMC.2017.2687918","article-title":"Cloud-based malware detection game for mobile devices with offloading","volume":"16","author":"Xiao","year":"2017","journal-title":"IEEE Trans. Mob. Comput."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Zhao, G., Zhang, C., and Zheng, L. (2017, January 21\u201324). Intrusion detection using deep belief network and probabilistic neural network. Proceedings of the 2017 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC), Guangzhou, China.","DOI":"10.1109\/CSE-EUC.2017.119"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"1141","DOI":"10.1007\/s12652-017-0558-5","article-title":"Detecting crypto-ransomware in IoT networks based on energy consumption footprint","volume":"9","author":"Azmoodeh","year":"2018","journal-title":"J. Ambient. Intell. Humaniz. Comput."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"391","DOI":"10.1016\/j.neucom.2016.06.021","article-title":"A two-level hybrid approach for intrusion detection","volume":"214","author":"Guo","year":"2016","journal-title":"Neurocomputing"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"18473","DOI":"10.1007\/s00521-022-07454-4","article-title":"Adam or Eve? Automatic users\u2019 gender classification via gestures analysis on touch devices","volume":"34","author":"Guarino","year":"2022","journal-title":"Neural Comput. Appl."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Seeland, M., and M\u00e4der, P. (2021). Multi-view classification with convolutional neural networks. PLoS ONE, 16.","DOI":"10.1371\/journal.pone.0245230"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"108614","DOI":"10.1016\/j.comnet.2021.108614","article-title":"An automatic mechanism to provide privacy awareness and control over unwittingly dissemination of online private information","volume":"202","author":"Guarino","year":"2022","journal-title":"Comput. Netw."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Ganesan, S., Ravi, V., Krichen, M., Sowmya, V., Alroobaea, R., and Soman, K. (2021, January 10\u201312). Robust malware detection using residual attention network. Proceedings of the 2021 IEEE International Conference on Consumer Electronics (ICCE), Las Vegas, NV, USA.","DOI":"10.1109\/ICCE50685.2021.9427623"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Ben Fredj, O., Mihoub, A., Krichen, M., Cheikhrouhou, O., and Derhab, A. (2020, January 4\u20137). CyberSecurity attack prediction: A deep learning approach. Proceedings of the 13th International Conference on Security of Information and Networks, Merkez, Turkey.","DOI":"10.1145\/3433174.3433614"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"107716","DOI":"10.1016\/j.compeleceng.2022.107716","article-title":"Denial of service attack detection and mitigation for internet of things using looking-back-enabled machine learning techniques","volume":"98","author":"Mihoub","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Aazam, M., St-Hilaire, M., Lung, C.H., Lambadaris, I., and Huh, E.N. (2018). IoT resource estimation challenges and modeling in fog. Fog Computing in the Internet of Things, Springer.","DOI":"10.1007\/978-3-319-57639-8_2"},{"key":"ref_48","first-page":"89","article-title":"Long short term memory networks for anomaly detection in time series","volume":"89","author":"Malhotra","year":"2015","journal-title":"Proceedings"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/23\/9305\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:29:28Z","timestamp":1760146168000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/23\/9305"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,29]]},"references-count":48,"journal-issue":{"issue":"23","published-online":{"date-parts":[[2022,12]]}},"alternative-id":["s22239305"],"URL":"https:\/\/doi.org\/10.3390\/s22239305","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,11,29]]}}}