An approach for detecting novel cross-architecture malware in IoT devices

The rapid proliferation of Internet of Things (IoT) devices has led to increasingly sophisticated malware capable of targeting heterogeneous processor architectures. However, existing cross-architecture IoT malware datasets remain limited in size, architectural diversity, and class balance, making it difficult to develop robust detection models. Furthermore, existing data augmentation methods, such as Variational Autoencoders (VAEs) and Generative Adversarial Networks (GANs), primarily generate samples within the original feature distribution and do not explicitly exploit semantic relationships across processor architectures. This paper proposes a novel cross-architecture IoT malware detection framework based on semantic opcode sequence transformation and lightweight machine learning. Opcode sequences are first embedded using FastText and aligned across heterogeneous architectures through an affine transformation model. Cosine similarity, Bayesian probabilistic opcode mapping, and statistical language modeling are then jointly employed to generate reliable cross-architecture opcode sequences for data augmentation while preserving semantic consistency. The transformed samples are subsequently used to train lightweight machine learning classifiers for detecting both known and previously unseen malware. Experimental results on multi-architecture IoT malware datasets demonstrate that the proposed framework achieves 99.42% accuracy and 99.37% F1-score while maintaining low computational overhead, making it suitable for resource-constrained IoT devices and effective for cross-architecture malware detection.