Evaluation of a BERT-Based Classification Model for Five Types of IoT Security Threats

As IoT devices continue to evolve, various attacks and security vulnerabilities are being exposed, and existing detection models have proven ineffective against zero-day attacks.Against this backdrop, research is needed on detection models capable of addressing IoT attacks.This study focuses on BERT, LSTM, and a hybrid model combining them, which provides high detection performance through rapid, large-scale pre-training.The research objective is to evaluate whether LLM-based dynamic analysis can replace existing methods and possess detection capabilities to counter continuously evolving cyber threats.The research methodology applied in our study involves conducting experiments on five target categories: Adware, Banking, SMS malware, Riskware, and Benign.We compare the detection performance of models utilizing BERT-based analysis with static analysis through quantitative results such as prediction success rate and prediction confidence.Performance evaluation metrics included detection status (misclassification induction: True/False), Cross-Correlation, Cosine Similarity, and Pearson Correlation.Crucially, our research went beyond simple model performance comparisons; we analyzed data, attempted model interpretation, and experimented with various methods to enhance detection confidence.Recognizing the limitations of intermediate steps (static analysis, simple binary classification), we ultimately expanded the project to include BERT-based multi-class classification.Consequently, we confirmed that while static analysisbased approaches have inherent limitations in detecting zero-day vulnerabilities and other attacks, dynamic analysis-based approaches enable the detection of such attacks.