# Deep-Learning-Based Approach for IoT Attack and Malware Detection
## 4 Experimental Results
Table 5 summarizes the performance metrics of the model for various malware classes in the CIC-MalMem-2022 dataset. The model exhibited high performance in the BENIGN class with an accuracy of 96.55%, a precision of 99.60%, a recall of 96.32%, and an F1-score of 97.93%. For DDoS attacks, the model achieved an accuracy of 99.90%, a precision of 97.16%, and a recall of 98.51%, demonstrating high detection success. In classes such as Web Attack Brute Force, Web Attack SQL Injection, and Heartbleed, the model displayed its highest performance with accuracies close to 100%, precision near 100%, and recall values over 99%. Specifically, for Web Attack SQL Injection and Heartbleed classes, it achieved perfect detection with 100% accuracy, 100% precision, and 100% recall. However, the performance metrics were lower for some classes, such as Bot, FTP-Patator, and SSH-Patator. For example, in the Bot class, the model achieved 69.66% accuracy, 34.24% precision, and 45.91% recall, indicating difficulties in detecting this type of malware. Overall, the model performed well in many malware classes, but improvements are needed for classes where \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Class No** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 Score (\%)** \\ \hline
1 & 99.97 & 99.95 & 99.98 & 99.97 \\
2 & 99.97 & 99.97 & 99.95 & 99.97 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Summary of results (%) obtained for different classes in the CIC-MalMem-2022 dataset. Figure 9: Comparison of machine-learning methods. performance was lower. These results indicate that while the model is generally effective for malware detection, optimization is necessary to achieve better results in certain classes. In the experiments, the performance of the proposed 1D CNN model was evaluated across various datasets. The model demonstrated high performance across many malware classes in the CIC-MalMem-2022 dataset, achieving 100% accuracy, precision, and recall for the Web Attack SQL Injection and Heartbleed classes. However, performance discrepancies were noted, particularly in the \"Backdoor_Malware\" and \"DNS_Spoofing\" classes. The lower performance in these classes can be attributed to several factors. For \"Backdoor_Malware\", the stealthy nature of these attacks often involves techniques that evade detection by blending in with legitimate traffic. This makes it challenging for the model to differentiate between malicious and benign behaviors. Similarly, \"DNS_Spoofing\" exploits vulnerabilities in the domain name resolution process, often resulting in patterns that mimic normal network activity. These complexities necessitate more advanced feature extraction and training strategies to improve detection rates for such sophisticated attack types. In the CIC IoT 2023 dataset, the model achieved high accuracy rates, exceeding 99.95% for attack types such as DDoS-ICMP_Flood and DDoS-PSHACK_Flood. However, as previously mentioned, the model's efficacy was notably lower for the more nuanced classes like \"Backdoor_Malware\" and \"DNS_Spoofing\". This highlights the need for continued refinement in detection algorithms to address the challenges posed by these advanced threats. In the CIC-IDS2017 dataset, the model exhibited effective detection of network attacks, generally showcasing high validation accuracy. These results confirm that while the proposed model is robust across various security domains--such as malware detection, IoT security, and network attack detection--there remains a critical need for enhancements in handling complex attack vectors.