在数据少且不断变化的条件下,测试四种机器学习模型对物联网恶意软件的检测效果。
Benchmarking Machine Learning Models for IoT Malware Detection under Data Scarcity and Drift
- 用四种模型在有限数据下做恶意软件分类,比较其表现。
- 树模型在少量数据下准确率高,但随时间推移性能下降。
- 适合需要轻量级、能适应威胁变化的物联网安全系统开发者。
物联网在智慧城市、交通和工业系统中的快速扩展加剧了其安全漏洞问题。由于计算资源受限、缺乏物理防护且网络环境异构动态,物联网设备极易成为网络攻击和恶意软件的目标。机器学习为自动化恶意软件检测与分类提供了可行方案,但实际部署需兼顾高效性与轻量化。本研究基于IoT-23数据集,评估四种监督学习模型(随机森林、LightGBM、逻辑回归、多层感知机)在二分类与多分类任务中的表现,分析其对训练数据量的敏感性,并通过时间演化模拟评估模型在不断变化的威胁环境下的鲁棒性。结果表明,树模型在数据稀缺时仍具高准确率与泛化能力,但随着恶意软件多样性增加,性能随时间下降。研究强调,在真实环境中部署自适应、资源高效的机器学习模型对保障物联网安全至关重要。
原文摘要 · Abstract (English)
The rapid expansion of the Internet of Things (IoT) in domains such as smart cities, transportation, and industrial systems has heightened the urgency of addressing their security vulnerabilities. IoT devices often operate under limited computational resources, lack robust physical safeguards, and are deployed in heterogeneous and dynamic networks, making them prime targets for cyberattacks and malware applications. Machine learning (ML) offers a promising approach to automated malware detection and classification, but practical deployment requires models that are both effective and lightweight. The goal of this study is to investigate the effectiveness of four supervised learning models (Random Forest, LightGBM, Logistic Regression, and a Multi-Layer Perceptron) for malware detection and classification using the IoT-23 dataset. We evaluate model performance in both binary and multiclass classification tasks, assess sensitivity to training data volume, and analyze temporal robustness to simulate deployment in evolving threat landscapes. Our results show that tree-based models achieve high accuracy and generalization, even with limited training data, while performance deteriorates over time as malware diversity increases. These findings underscore the importance of adaptive, resource-efficient ML models for securing IoT systems in real-world environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。