# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 5 Results and Discussion  
In the CNN performance evaluation experiment, among the 9339 grayscale malware image samples included in the Malimg dataset, 70% (6537 pieces) were used for training, and 30% (2802 pieces) were used for validation. Table 10 compares and analyzes the performance while changing the input image size and two important hyperparameters (dropout and learning rate) to find the optimal hyperparameters in the experimental process [105]. For the input image of the neural network, the training performed with 112 \(\times\) 112 pixel size and hyperparameters of 2 showed the best results. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**No.** & **Image Size** & **Dropout** & **Learning Rate** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1-Score (\%)** \\ \hline \multirow{3}{*}{2} & 1 & 64 \(\times\) 64 & 0.45 & 0.0001 & 97.93 & 98.02 & 97.91 & 97.96 \\  & 112 \(\times\) 112 & 0.45 & 0.0001 & 98.93 & 98.93 & 98.93 & 98.92 \\  & 192 \(\times\) 192 & 0.45 & 0.0001 & 98.36 & 98.47 & 98.30 & 98.38 \\  & 112 \(\times\) 112 & 0.45 & 0.0005 & 95.54 & 95.60 & 95.56 & 95.58 \\  & 112 \(\times\) 112 & 0.45 & 0.0010 & 97.86 & 97.87 & 97.87 & 97.87 \\  & 112 \(\times\) 112 & 0.35 & 0.0001 & 98.04 & 98.05 & 98.01 & 98.03 \\  & 112 \(\times\) 112 & 0.55 & 0.0001 & 98.32 & 98.44 & 98.20 & 98.32 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Performance comparison according to input image and hyperparameter setting changes. \begin{table}
\begin{tabular}{l l} \hline \hline
**Parameter** & **Description** \\ \hline True Positive (_TP_) & Number of malware correctly identified as malware \\ True Negative (_TN_) & Number of non-malware correctly identified as non-malware \\ False Positive (_FP_) & Number of non-malware incorrectly identified as malware \\ False Negative (_FN_) & Number of malware incorrectly identified as non-malware \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Performance metric parameters. Table 11 shows the specific performance evaluation results for 2 in Table 10. The overall classification accuracy achieved for 9339 samples of 25 malware classes was as follows: accuracy of 98.93%, precision of 98.93%, recall of 98.93%, and \(F1\)-score of 98.92%. The Malimg dataset used in this experiment had a problem of class imbalance. As a class with a small number of samples had poor predictive ability, the imbalance in the data was handled by assigning class weights to solve this problem [100]. This method automatically adjusted weights that were inversely proportional to the class frequencies of the input data, which was a method where a higher weight was given to the minority class hierarchy and a lower weight was given to the majority class hierarchy. In the imbalanced data, F1-score is important in addition to accuracy. The F1-score is the weighted average of the precision and recall values. Because it considers false positives and false negatives, it is a more useful index than accuracy to evaluate a model when the classes of the collected data are imbalanced. Figure 9 shows the (a) training accuracy and (b) training loss achieved by the proposed CNN-based malware classification learning model. A steady increase in training accuracy and a decrease in training loss can be confirmed in these graphs. This indicates that the proposed model does not have overfitting or underfitting problems. Figure 10 shows a heatmap of the confusion matrix generated from the Malimg dataset to verify the performance of the proposed CNN model. However, there is some confusion between Swizzor.gen!E and Swizzor.gen!I. This may be due to the high similarity between these class samples, suggesting that these are variant samples belonging to the same family. Therefore, additional samples seem to be required to accurately learn the hidden characteristics among these malware families. With the exception of that issue, the overall classification is accurate.