Open Access

ARTICLE

Hybrid Malware Detection Model for Internet of Things Environment

Abdul Rahaman Wahab Sait^1,*, Yazeed Alkhurayyif²

1 Department of Documents and Archive, Center of Documents and Administrative Communication, King Faisal University, P.O. Box 400, Al-Ahsa, Hofuf, 31982, Saudi Arabia
2 Department of Computer Science, College of Computer Science, Shaqra University, Shaqra, 11961, Saudi Arabia

* Corresponding Author: Abdul Rahaman Wahab Sait. Email:

Computers, Materials & Continua 2026, 86(3), 81 https://doi.org/10.32604/cmc.2025.072481

Received 27 August 2025; Accepted 09 December 2025; Issue published 12 January 2026

Abstract

Malware poses a significant threat to the Internet of Things (IoT). It enables unauthorized access to devices in the IoT environment. The lack of unique architectural standards causes challenges in developing robust malware detection (MD) models. The existing models demand substantial computational resources. This study intends to build a lightweight MD model to detect anomalies in IoT networks. The authors develop a transformation technique, converting the malware binaries into images. MobileNet V2 is fine-tuned using improved grey wolf optimization (IGWO) to extract crucial features of malicious and benign samples. The ResNeXt model is combined with the Linformer’s attention mechanism to identify Malware features. A fully connected layer is integrated with gradient-weighted class activation mapping (Grad-CAM) in order to facilitate an interpretable classification model. The proposed model is evaluated using the IoT malware and the IoT-23 datasets. The model performs well on the two datasets with an accuracy of 98.94%, precision of 98.46%, recall of 98.11%, and F1-score of 98.28% on the IoT malware dataset, and an accuracy of 98.23%, precision of 96.80%, recall of 96.64%, and F1-score of 96.71% on the IoT-23 dataset, respectively. The findings indicate that the model has a high standard of classification. The lightweight architecture enables efficient deployment with an inference time of 1.42 s. Inference time has no direct impact on accuracy, precision, recall, or F1-score. However, the inference speed would warrant timely detection in latency-sensitive IoT applications. By achieving a remarkable result, the proposed study offers a comprehensive solution: a scalable, interpretable, and computationally efficient MD model for the evolving IoT landscape.

---

Keywords

---