Comparative Study of Deep Learning Models for Malware Detection in IoT Networks: CNN, LSTM, and Hybrid Architectures

Abstract

The rapid expansion of the Internet of Things (IoT) has intensified security concerns. Many IoT devices operate with limited computational resources and inadequate built-in protection. This makes them vulnerable to malware attacks such as Distributed Denial-of-Service (DDoS), botnets, and ransomware. Traditional signature-based detection techniques struggle to identify evolving and previously unseen threats, highlighting the need for intelligent detection mechanisms. This study proposes a Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) model for effective IoT malware detection. The CNN component extracts spatial features from network traffic, including packet-level and flow-based characteristics. The LSTM component captures temporal dependencies and sequential attack patterns. By integrating spatial and temporal learning, the hybrid architecture enhances detection capability for both known and zero-day attacks. Experimental results demonstrate superior performance compared to standalone CNN and LSTM models, achieving 99.92% accuracy, precision, recall, and F1-score, with a ROC-AUC of 0.999703.