# Deep-Learning-Based Approach for IoT Attack and Malware Detection
## 4 Experimental Results
There are also classes with moderate performance, such as DoS-HTTP_Flood (93.30% accuracy, 73.77% precision, and 82.40% recall) and MITM-ArpSpoofing (78.18% accuracy, 58.59% precision, and 66.98% recall). Overall, while the model is successful in some attack types, it requires improvement in others. Table 4 presents a summary of the results obtained for different classes in the CIC-MalMem-2022 dataset. For the first class, the accuracy, precision, recall, and F1-scores are 99.97%, 99.95%, 99.98%, and 99.97%, respectively. These high-performance indicators demonstrate that the model is extremely successful in accurately classifying malware in the first class. For the second class, the accuracy, precision, recall, and F1-score are reported as 99.97%, 99.95%, and 99.97%, respectively. These values indicate that the model also detects malware in the second class with high accuracy and reliability. The obtained results prove that the employed model is highly effective in classifying malware classes in the CIC-MalMem-2022 dataset and exhibits high overall performance. This supports the model's applicability for practical malware detection. \begin{table}
\begin{tabular}{c l c c c} \hline \hline
**Class No** & **Class Name** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 Score (\%)** \\ \hline
1 & Backdoor\_Malware & & & 4.56 & 8.73 \\
2 & BenignTraffic & & 100.00 & 95.85 & 86.17 \\
3 & BrowserHijacking & & 7.51 & 13.95 \\
4 & CommandInjection & & 98.51 & 3.94 & 7.58 \\
5 & DDoS-ACK\_Fragmentation & & 97.96 & 98.89 \\
6 & DDoS-HTTP\_Flood & & 68.69 & 72.93 \\
7 & DDoS-ICMP\_Flood & & 99.91 & 99.93 \\
8 & DDoS-ICMP\_Fragmentation & & 98.01 & 98.65 \\
9 & DDoS-PSHACK\_Flood & & 99.92 & 99.94 \\
10 & DDoS-RSTIFNFIood & & 99.96 & 99.91 & 99.95 \\
11 & DDoS-SYN\_Flood & & 99.78 & 99.69 \\
12 & DDoS-SlowLoris & & 78.09 & 66.89 \\
13 & DDoS-SynonymousIP\_Flood & & 99.79 & 99.82 \\
14 & DDoS-TCP\_Flood & & 99.85 & 99.82 \\
15 & DDoS-UDP\_Flood & & 99.89 & 97.66 & 98.74 \\
16 & DDoS-UDP\_Fragmentation & & & 26.71 & 34.43 \\
17 & DNS\_Spoofing & 98.36 & 48.41 & 12.10 & 19.88 \\
18 & DictionaryBruteForce & & 73.77 & 82.40 \\
19 & DoS-HTTP\_Flood & & 93.30 & 99.61 & 98.68 \\
20 & DoS-SYN\_Flood & & 99.61 & 99.66 \\
21 & DoS-TCP\_Flood & & 99.72 & 99.69 & 99.48 \\
22 & DDoS-UDP\_Flood & & 58.59 & 66.98 \\
23 & MITM-ArpSpoofing & & 78.18 & 95.88 & 95.41 \\
24 & Mirai-greeth\_flood & & 92.60 & 93.56 \\
25 & Mirai-qrep\_flood & & 94.53 & 99.35 & 99.62 \\
26 & Mirai-udpplain & & 72.03 & 65.52 \\
27 & Recon-HostDiscovery & & 15.88 & 22.87 \\
28 & Recon-OSScan & & 4.12 & 7.91 \\
29 & Recon-PortsScan & & 30.57 & 34.42 \\
30 & SciInjection & & 3.30 & 6.40 \\
32 & Uploading\_Attack & & 35.64 & 52.55 \\
33 & VulnerabilityScan & & 74.93 & 79.95 \\
34 & XSS & & 36.92 & 53.92 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Summary of results (%) obtained for different classes in the CIC IoT 2023 dataset. The features extracted from the FC_9 fully connected layer of the 1D CNN model presented in Figure 9 were classified using the MATLAB classification layer with 10-fold cross-validation. The classification results are depicted in the attached graph. While this proposed model achieved an accuracy of 99.97%, the results for kNN [35], SVM [36; 37; 38], Neural Network [39; 40], Naive Bayes [41], Tree [42], and Efficient Logistic Regression [42] were 98.68%, 98.56%, 98.16%, 88.58%, 87.78%, and 60.9%, respectively (see Figure 9). These results not only demonstrate the superior accuracy of the proposed model in comparison to other methods but also highlight its high performance and generalization capability. The stability and generalization capabilities of the proposed model were validated using cross-validation and independent test sets. The low variance in results indicates consistent performance across different subsets of data. This demonstrates that this model can reliably operate across a wide range of conditions and generalize with high accuracy to different datasets.