A deep learning-based IoT malware detection approach for electric vehicle charging stations

As Electric Vehicle (EV) charging stations become increasingly intelligent, more Internet of Things (IoT) devices are being integrated to improve operational efficiency. Efficient and accurate detection of IoT malware is crucial to ensuring the stable and reliable operation of these charging systems. However, existing research in this field still exhibits three major limitations. First, most existing research lack unified adaptability across multiple CPU architectures. They are typically designed for a single architecture, such as ARM or MIPS, which limits their applicability in heterogeneous IoT environments. Second, the feature extraction dimensions in most approaches are limited, making it difficult to comprehensively capture both the structural and behavioral characteristics of malware. Third, existing multimodal feature fusion methods lack dynamic weighting mechanisms and rely on simplistic fusion strategies, making it difficult to achieve deep integration and effective analysis of multimodal features. To address the aforementioned limitations, this paper proposes a deep learning-based IoT malware detection approach for EV charging stations. The approach first incorporates a decompilation tool to convert opcodes from multiple CPU architectures into a unified intermediate representation, PCode, enabling consistent feature modeling across heterogeneous architectures. To enhance the comprehensiveness and discriminative power of feature representation, the approach integrates three types of features: global structural features derived from binary grayscale images, as well as statistical and semantic features extracted from PCode. Each feature type is processed using a dedicated deep-learning algorithm for its characteristics. Finally, a multimodal feature fusion model is designed, using a dynamic weighting mechanism and a multi-layer encoder to achieve deep integration and interactive modeling of the three feature types. Experiments conducted on the public IoT malware datasets demonstrate that the proposed approach outperforms existing mainstream approaches in metrics such as F1, achieving an improvement of 1.37%, which validates its effectiveness in IoT malware detection area.