IOT-Malware

IOT-Malware is a machine learning system for detecting and classifying IoT malware using neural networks and TF-IDF vectorization of function call graphs (FCGs).

Language: Python
Repository: github.com/th30d4y/IOT-Malware

Malware Families

The classifier targets the following IoT malware families:

• Ddostf
• Dofloo
• Gafgyt
• Mirai
• Mobidash
• Rootnik
• Tsunami

Tech Stack

Layer	Technology
Language	Python 3.8+
Deep Learning	PyTorch
Feature Engineering	Scikit-learn (TF-IDF)
Data Handling	Pandas, NumPy, OpenPyXL
Visualization	Matplotlib
Interface	Jupyter Notebook

Installation

pip install torch torchvision
pip install pandas numpy scikit-learn
pip install matplotlib tqdm openpyxl
pip install jupyter notebook

Usage

1. Preprocess

Run TF-IDF vectorization on the raw function call graph data:

python tfidf_vectorizer.py

This produces vectorized_tfidf.csv.

2. Train

Train the MLP neural network:

python mlp_trainer.py

The best checkpoint is saved to optimized_gradual_model.pth.

Model Architecture

A 4-layer MLP:

Input → 512 neurons
512   → 256  (ReLU + BatchNorm + Dropout)
256   → 128  (ReLU + BatchNorm + Dropout)
128   → num_classes  (logits)

Training Parameters

Parameter	Value
Batch size	32
Learning rate	2e-4
Dropout rate	0.4
Weight decay	5e-4
Max epochs	60
Early stopping patience	15

Dataset Format

• .data files — function call edges, one caller#callee pair per line
• .label files — malware family name per sample

Data sourced from the CyberAI2025 Dataset.

Output Files

File	Description
vectorized_tfidf.csv	Primary training feature file
optimized_gradual_model.pth	Best saved model weights
test_predictions_submission.csv	Submission-ready predictions
optimized_gradual_curves.png	Loss/accuracy training plots

Expected Performance

Metric	Value
Training accuracy	~95–98%
Validation accuracy	~85–92%
Random baseline (7 classes)	~14.3%
Inference speed	< 1ms per sample
Training time	15–30 min (hardware-dependent)