A Lightweight Drift-Aware Continual Learning Framework for IoT Malware Detection Across Evolving Sessions
DOI:
https://doi.org/10.56714/bjrs.52.1.22Keywords:
IoT Malware Detection, continual learning, concept drift, PSI, IoT-23Abstract
IoT malware detection is commonly evaluated under static train–test settings, whereas real-world deployments operate over continuous traffic streams where both benign behavior and attack patterns evolve over time. This paper presents a lightweight drift-aware continual learning framework for IoT malware detection, evaluated on the IoT-23 dataset within a session-based evolution setting. The model is built on a compact multilayer perceptron and examined under six continual learning configurations, including replay, Elastic Weight Consolidation (EWC), Synaptic Intelligence (SI), and their combinations.
A prequential evaluation protocol is adopted, where each incoming session is first evaluated and then incrementally incorporated into the model, rather than relying solely on final test outcomes. To better understand distributional changes, the workflow tracks Population Stability Index (PSI) across consecutive sessions and reports forgetting behavior alongside Accuracy and Macro-F1.
In the re-evaluated results, the NR_EWC configuration achieved the most balanced overall performance, with an average Macro-F1 of 0.7918, an average accuracy of 0.9887, and moderate forgetting (0.0660). In contrast, the NR_NoReg baseline achieved high accuracy (0.9864) but exhibited the highest forgetting (0.2137), indicating that accuracy alone may mask stability limitations under drift conditions
Downloads
References
[1] S. Garcia, A. Parmisano, and M. J. Erquiaga, "IoT-23: A labeled dataset with malicious and benign IoT network traffic," Zenodo, 2020, DOI: 10.5281/zenodo.4743746.
[2] E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, "CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment," Sensors, vol. 23, no. 13, p. 5941, 2023, DOI: 10.3390/s23135941.
[3] J. Ramamoorthy, K. Gupta, R. C. Kafle, N. K. Shashidhar, and C. Varol, "A novel static analysis approach using system calls for Linux IoT malware detection," Electronics, vol. 13, no. 15, p. 2906, 2024, DOI: 10.3390/electronics13152906.
[4] M. Chin and R. Corizzo, "Continual semi-supervised malware detection," Machine Learning and Knowledge Extraction, vol. 6, no. 4, pp. 2829–2854, 2024, DOI: 10.3390/make6040135.
[5] M. Al-Fawa’reh, J. Abu-Khalaf, P. Szewczyk, and J. J. Kang, "MalBoT-DRL: Malware botnet detection using deep reinforcement learning in IoT networks," IEEE Internet of Things Journal, vol. 11, no. 6, pp. 9610–9629, 2024, DOI: 10.1109/JIOT.2023.3324053.
[6] M. E. Farfoura et al., "A novel lightweight machine learning framework for IoT malware classification based on matrix block mean downsampling," Ain Shams Engineering Journal, vol. 16, no. 1, p. 103205, 2025, DOI: 10.1016/j.asej.2024.103205.
[7] N. A. H. Fathima et al., "Adaptive memory replay for network intrusion detection: Tackling data drift and catastrophic forgetting," Computer Networks, 2025, DOI: 10.1016/j.comnet.2025.111712.
[8] C. Guo, X. Li, J. Cheng, S. Yang, and H. Gong, "Continual learning for intrusion detection under evolving network threats," Future Internet, vol. 17, no. 10, p. 456, 2025, DOI: 10.3390/fi17100456.
[9] I. Mutambik et al., "AI-driven cybersecurity in IoT: Adaptive malware detection and lightweight encryption via TRIM-SEC framework," Sensors, vol. 25, no. 22, p. 7072, 2025, DOI: 10.3390/s25227072.
[10] Z. Chen et al., "HoleMal: A lightweight IoT malware detection framework based on efficient host-level traffic processing," Computers & Security, vol. 151, p. 104206, 2025, DOI: 10.1016/j.cose.2025.104206.
[11] M. R. A. Khan et al., "Lightweight quantized XGBoost for botnet detection in resource-constrained IoT networks," IoT, vol. 6, no. 4, p. 70, 2025, DOI: 10.3390/iot6040070.
[12] A. Patel et al., "FL-MalDrift: A federated learning framework for malware detection under local concept drift," Scientific Reports, vol. 16, p. 1821, 2026, DOI: 10.1038/s41598-025-31592-z.
[13] J. Lyon, K. Goyal, and C. Doerr, "Benchmarking machine learning models for IoT malware detection under data scarcity and drift," arXiv preprint arXiv:2601.18736, 2026.
[14] B. M. Kouassi et al., "Top-K feature selection for IoT intrusion detection: Contributions of XGBoost, LightGBM, and random forest," Future Internet, vol. 17, no. 11, p. 529, 2025, DOI: 10.3390/fi17110529.
[15] Y. M. Yang et al., "A lightweight training approach for MITM detection in IoT networks: Time-window selection and generalization," Applied Sciences, vol. 15, no. 22, p. 12147, 2025, DOI: 10.3390/app152212147.
[16] A. Wakili and S. Bakkali, "A resilient IoT intrusion detection system using hybrid feature selection and explainable ensemble learning," Results in Engineering, vol. 30, p. 107392, 2025, DOI: 10.1016/j.rineng.2025.107392.
[17] A. R. W. Sait et al., "Hybrid malware detection model for Internet of Things environment," Journal of Network and Computer Applications, vol. 242, p. 104355, 2026, DOI: 10.1016/j.jnca.2026.104355.
[18] M. Maghanaki et al., "Systematic evaluation of machine learning and deep learning models for IoT malware detection across multiple attack types," Sensors, vol. 26, no. 6, p. 1750, 2026, DOI: 10.3390/s26061750.
[19] J. Kirkpatrick et al., "Overcoming catastrophic forgetting in neural networks," Proc. Natl. Acad. Sci., vol. 114, no. 13, pp. 3521–3526, 2017, DOI: 10.1073/pnas.1611835114.
[20] F. Zenke, B. Poole, and S. Ganguli, "Continual learning through synaptic intelligence," in Proc. ICML, vol. 70, pp. 3987–3995, 2017.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Journal of Basrah Researches (Sciences)
This work is licensed under a Creative Commons Attribution 4.0 International License.
This journal is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
Under this license, users are permitted to read, download, copy, distribute, print, search, link to the full texts of articles, and create derivative works, including for commercial purposes, provided that appropriate credit is given to the original author(s) and the source.
Authors retain the copyright of their published work, while granting the Journal of Basrah Researches Sciences (JBRS) the right of first publication. Proper attribution must include the article title, author name(s), journal name, DOI, and a link to the Creative Commons license.
