An IoT Malware Detection Framework Based on Large Language Models and Deep Learning Techniques

Rapid growth in IoT devices has led to the creation of crucial cybersecurity threats since existing methods of malware detection which use signature matching and numerical feature analysis are incapable of capturing the contextual behavioral semantics of IoT attacks. The presented work proposes an innovative malware detection framework incorporating a pipeline of behavior-to-text transformation together with transformer-based Large Language Models (LLMs) to perform binary classification of IoT network traffic. Selected through the process of SHAP-based feature importance analysis, the numerical features of network flows from the initial set of 41 features are transformed into natural language descriptions, allowing encoder-based LLMs to capture the context of IoT traffic behavior. Four LLMs, including DistilBERT, BERT-base, RoBERTa, and DeBERTa, were fine-tuned and rigorously tested against four Deep Learning baselines, Neural Network, LSTM, BiLSTM, and CNN, and four Machine Learning baselines, Random Forest, XGBoost, LightGBM, and CatBoost, using the CIC-IoT-2023 dataset under three experimental setups: balanced classification, realistic imbalanced distribution, and unseen variant detection. Additionally, a four-class multi-class classification experiment and an ablation study were conducted to further validate the framework. On a balanced dataset consisting of 400,000 samples, BERT-base and RoBERTa achieved the highest F1-scores of 98.94% with precision above 99.96%. In the imbalanced case of 90% attack and 10% benign traffic, the precision of all models was equal to 99.99%. The framework attained an F1-score of 99.99% for unseen variant detection on a completely unseen Mirai botnet variant with zero false negatives. The four-class multi-class experiment achieved a Macro F1-score of 88.80%. Statistical analysis across three independent runs confirmed high result stability with standard deviations below 0.03%. SHAP analysis revealed that packet count, ACK flag number, and HTTPS indicator were the most discriminative features, while attention visualization confirmed token-level interpretability. All LLMs consistently outperformed all Deep Learning baselines, providing evidence for the effectiveness of the behavior-to-text transformation paradigm for IoT malware detection, while classical ML models achieved marginally higher F1-scores due to their efficiency with numerical features, providing evidence for the effectiveness of the behavior-to-text transformation paradigm for IoT malware detection.