MTHAEL: Cross-architecture iot malware detection based on neural network advanced ensemble learning

Danish Vasan, Mamoun Alazab, Sitalakshmi Venkatraman, Junaid Akram, Zheng Qin

Research output: Contribution to journalArticlepeer-review


The complexity, sophistication, and impact of malware evolve with industrial revolution and technology advancements. This article discusses and proposes a robust cross-architecture IoTmalware threat hunting model based on advanced ensemble learning (MTHAEL). Our unique MTHAEL model using stacked ensemble of heterogeneous feature selection algorithms and state-of-the-art neural networks to learn different levels of semantic features demonstrates enhanced IoTmalware detection than existing approaches. MTHAEL is the first of its kind that effectively optimizes recurrent neural network (RNN) and convolutional neural network (CNN) with high classification accuracy and consistently low computational overheads on different IoTarchitectures. Cross-architecture benchmarking is performed during the training with different architectures such as ARM, Intel80386, MIPS, and MIPS+Intel80386 individually. Two different hardware architectureswere employed to analyze the architecture overhead, namely Raspberry Pi 4 (ARM-based architecture) and Core-i5 (Intel-based architecture). Our proposed MTHAEL is evaluated comprehensively with a large IoTcross-architecture dataset of 21,137 samples and has achieved 99.98 percent classification accuracy for ARMarchitecture samples, surpassing prior related works. Overall, MTHAEL has demonstrated practical suitability for cross-architecture IoTmalware detection with low computational overheads requiring only 0.32 seconds to detect Any IoTmalware.

Original languageEnglish
Article number9165209
Pages (from-to)1654-1667
Number of pages14
JournalIEEE Transactions on Computers
Issue number11
Early online date11 Aug 2020
Publication statusPublished - Nov 2020


Dive into the research topics of 'MTHAEL: Cross-architecture iot malware detection based on neural network advanced ensemble learning'. Together they form a unique fingerprint.

Cite this