# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 5 Results and Discussion
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**ID** & **Class Name** & **Malware Type** & **Precision** & **Recall** & **F1-Score** & **Support** \\ \hline
0 & Adialer.C & Dialer & 1.00 & 1.00 & 1.00 & 37 \\
1 & Agent.FYI & Backdoor & 1.00 & 1.00 & 1.00 & 35 \\
2 & Allaple.A & Worm & 0.99 & 1.00 & 1.00 & 885 \\
3 & Allaple.L & Worm & 1.00 & 1.00 & 1.00 & 477 \\
4 & Alueron.gen!J & Worm & 0.98 & 1.00 & 0.99 & 59 \\
5 & Autorun.K & Worm: AutoIT & 1.00 & 1.00 & 1.00 & 32 \\
6 & C2 LOP.P & Trojan & 0.95 & 0.86 & 0.90 & 44 \\
7 & C2 LOP.gen!g & Trojan & 0.92 & 0.97 & 0.94 & 60 \\
8 & Dialplatform.B & Dialer & 1.00 & 1.00 & 1.00 & 53 \\
9 & Dontovo.A & Trojan Downloader & 1.00 & 1.00 & 1.00 & 49 \\
10 & Fakerean & Rogue & 1.00 & 0.98 & 0.99 & 114 \\
11 & Instantaccess & Dialer & 1.00 & 1.00 & 1.00 & 129 \\
12 & Lolyda.AA1 & PWS & 1.00 & 1.00 & 1.00 & 64 \\
13 & Lolyda.AA2 & PWS & 1.00 & 1.00 & 1.00 & 55 \\
14 & Lolyda.AA3 & PWS & 1.00 & 1.00 & 1.00 & 37 \\
15 & Lolyda.AT & PWS & 1.00 & 0.98 & 0.99 & 48 \\
16 & Malex.gen!J & Trojan & 1.00 & 0.95 & 0.97 & 41 \\
17 & Obfuscator.AD & Trojan Downloader & 1.00 & 1.00 & 1.00 & 43 \\
18 & Rbotgen & Backdoor & 1.00 & 1.00 & 1.00 & 47 \\
19 & Skintrim.N & Trojan & 1.00 & 1.00 & 1.00 & 24 \\
20 & Swizzor.gen!E & Trojan Downloader & 0.83 & 0.76 & 0.79 & 38 \\
21 & Swizzor.gen!I & Trojan Downloader & 0.81 & 0.85 & 0.83 & 40 \\
22 & VB.AT & Worm & 1.00 & 1.00 & 1.00 & 122 \\
23 & Wintrim.BX & Trojan Downloader & 0.90 & 0.97 & 0.93 & 29 \\
24 & Yuner.A & Worm & 1.00 & 1.00 & 1.00 & 240 \\  & & accuracy & & & 0.99 & 2802 \\  & macro avg & 0.98 & 0.97 & 0.97 & 2802 \\  & weighted avg & 0.99 & 0.99 & 0.99 & 2802 \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Classification performance analysis table. Among the proposed methods in the results comparison table, it can be seen that the architecture in [98] provides better performance. In the case of the architecture in [98], a multi-mode (VGG16 + Pyramid CNN) learning method was used, as shown in Table 13, for more differentiated feature extraction. This allowed the combination of two different types of deep learning architectures to obtain better classification performance. Because more weights are added to the existing millions of parameters in the model derived by using a pre-trained transfer learning-based model (VGG16) and Pyramid CNN [106] together, it requires a very large memory space, huge computational resources, and a long time for training. Therefore, it is unsuitable for distributed IIoT environments with limited hardware resources, such as smart factories, where a deep learning model using a simple architecture such as the model proposed in this paper is more efficient. On the other hand, the model using a hybrid architecture [96; 99] (e.g., CNN + LSTM) for malware classification did not show a significant increase in performance. The model proposed in this study does not use color image conversion and a resource-consuming transfer learning method, but it exhibits a high classification accuracy of 98.93% with lower computational cost. It can thus be stated that this is the most suitable model for the smart factory IIoT environment compared to other deep learning models.