CAMRA: Cross-Architecture Multimodal Reinforcement Learning with Federated Adaptation for IoT Malware Detection and Classification

Abstract The domain of Internet of Things (IoT) has been rapidly developing, consequently expanding the attack surface for malware that exploits vulnerabilities across various hardware architectures and evades conventional static detection techniques. Past frameworks for IoT malware detection and classification often rely on a single data modality or are designed for a specific device architecture, which limits their ability to detect and classify malware in heterogeneous environments. This paper proposes CAMRA, a cross-architecture malware detection and classification framework that combines multimodal data, Deep Reinforcement Learning (DRL), and Federated Learning (FL). Using the CIC-YNU-IoT-MAL-26 dataset, CAMRA fuses network-level (PCAP), hardware-level (SAR), and system-level (STRACE) data streams through cross-modal attention across the ARM, MIPS, MIPSEL, and x86 architectures. A DRL controller adapts the per-class loss weights during training to address class imbalance, and federated learning adapts the centrally trained model across architecture-specific clients while keeping their raw data local. Over ten random seeds, CAMRA achieves a Macro-F1 of $$0.752 \pm 0.012$$ (accuracy $$98.4\%$$ ), and the federated model achieves $$0.741 \pm 0.008$$ (accuracy $$98.6\%$$ ), outperforming every single-modality model and standard baseline. Ablation and paired statistical tests show that the frequency-based class weights and the loss function are the main drivers of performance, with the DRL controller performing on par with fixed class weighting. In holdout experiments, malware from unseen architectures and from an unseen malware family is detected as malicious, while an unseen ARM architecture leads to false alarms on benign data.