An Adaptive Sample-Weighting Framework for Imbalanced IoT Malware Family Classification

Abstract

The extensive adoption of IoT devices raises the risk of malware attacks on IoT environments. Moreover, the increasing variety of malware families highlights the need for efficient malware family-level classification for network protection. However, the severe class imbalance problem when some major malware families represent the majority of the data while some minor families include only few instances of malware represents a challenging issue of IoT malware-family classification. Traditional machine-learning-based classifiers may demonstrate high overall accuracy but lack satisfactory performance in recognizing minority classes under imbalanced conditions. This paper introduces the approach of sample-weighting adjustment for imbalanced malware family-level classification without generating artificial instances or eliminating any existing instances. The approach is tested on the ARM subset of the CIC-YNU-IoTMal 2026 dataset, which includes 737,651 records divided between eight classes related to malware. XGBoost is used as the basic classifier model and two variations – one including all 36 features and another one with 22 features – are investigated. The accuracy of the standard 36 feature XGBoost model is 72.01%, whereas the balanced accuracy and macro-F1 score of this model are 23.37% and 20.99%, respectively, proving the insufficiency of accuracy in the presence of extreme class imbalance. On the other hand, the adaptive weight assignment technique has been able to increase the balanced accuracy to 41.43% and macro-F1 to 27.51%, which are 18.06 and 6.52 percent higher than the previous case. The 22 feature adaptive model is able to achieve similar balanced accuracy of 41.45%, proving that this smaller representation is also capable of carrying the classification capabilities of the full set of features in the context of class imbalance. Even though the adaptive method reduces the accuracy of the model, the results obtained show its capacity to improve minority class recognition without changing the size of the dataset.