Two-Step Random Forest Classification with L1 Regularization Feature Selection for IoT Malware Detection

The increasing number of IoT devices raises the risk of cyberattacks on these devices. IoT devices are frequently equipped with weak security measures, making them susceptible to various malware, including spyware, ransomware, and trojans. Many existing studies primarily differentiate between benign and malicious networks, but they often overlook the importance of identifying specific types of malware. Recognizing the type of malware can significantly aid in making informed incident-handling decisions. Considering these risks, this study introduces an innovative two-step framework designed to not only detect potential attacks but also to pinpoint the specific type of malware involved. The initial step involves differentiating between benign and malicious network traffic, while the subsequent step identifies the specific type of malware, such as spyware, ransomware, or trojan. Both steps employ the Random Forest algorithm for classification. Furthermore, the Least Absolute Shrinkage and Selection Operator (L1 Regularization) method is utilized for feature selection during the training process, aimed at enhancing model performance. This research utilizes the CIC-MaIMem dataset, which captures malware attacks within IoT networks. From the experiment, it is found that the proposed model has better results than the one-step multiclass Random Forest model. Performance evaluation of the proposed model obtained an accuracy of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">${8 7. 2 4 {\%}}$</tex>, precision of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">${8 0. 7 9 {\%}}$</tex>, recall of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">${8 0. 8 1 {\%}}$</tex>, and F1-score of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">${8 0. 7 9 {\%}}$</tex>.