# Defense and Security Mechanisms in the Internet of Things: A Review
## 5 Defense Mechanisms in IoT Environments
### Malware Detection Systems  
[PERSON] et al. in [152] focused on how IoT malware data and detection mechanisms enhance the security posture of devices. The researchers proposed a Term Frequency-Inverse Document Frequency (TF-IDF) methodology to translate categorical properties into a numeric classification, thereby avoiding data reduction and minimising information storage space. The authors concluded that their method is by far better than direct encoding or the most common patterns that follow one-hot encoding; thus, the danger of information being lost is reduced, as there is no exposure to the shedding of features, and it can still limit the data dimensions to an acceptable range. Also, they suggested that this method can be used with N-grams [153] to produce more valuable patterns. The method achieved accuracy rates of 95.22%, 96.23%, 98.77%, and 99.56% on various datasets.  
[PERSON] et al. in [154] presented a method for identifying Android malware based on sensitive function call graphs (FCGs) and Graph Neural Networks (GNNs) [155]. They constructed sensitive FCGs, retrieved semantic properties for functional nodes, and subsequently embedded them into feature vectors via a GNN. A graph pruning technique safeguards sensitive API calls and diminishes the number of nodes in extensive FCGs. Additionally, they developed two models utilising the word2 vec methodology [156], enhanced by API2 vec [157] and opcode2 vec [158] techniques to preserve graph semantics and facilitate expedited model convergence. A subsequent chapter introduces the FCG-based paradigm, highlighting the need to represent various nodes and demonstrating that specific APIs can be recognised as high-impact nodes. The proposed method achieved a 98% F1-score for malware binary classification and a 96% F1-score for malware family classification.  
In their research [159], [PERSON] et al. suggested a method that finds a way to approach hybrids that utilise CNNs, LSTM, and Principal Component Analysis (PCA) for a problem such as malware detection. CNNs are used to capture the structure of the malware data, LSTM is used to model the time-dependent and sequential realisation patterns, and PCA is employed for the projection of data on a reduced number of subspaces. Applying the proposed hybrid approach enables the mission to combat participation in the public malware dataset with high model performance measures. Finally, the authors further state that it substantially decreases the time and resources needed for manual analysis and enhances such systems' security.  
[PERSON] et al. in [160] introduced the concept of Temporal-Incremental Malware Learning (TIML), a new approach for dealing with the evolving nature of malware distributions and detecting new threats promptly with low overhead. The authors developed a large-scale Android malware dataset for the TIML framework that will benefit future research. They applied four CIL algorithms to the TIML problem and found that all the approaches can classify malware families efficiently with restricted resources. Also, they suggested a new multimodal TIML approach that enhances classification performance by incorporating different types of malware data. Both were deposited in an open repository for academics to make the dataset and source code available for further research and promote development in this field.