Deep learning based XIoT malware analysis: A comprehensive survey, taxonomy, and research challenges

Abstract

The Internet of Things (IoT) and its broader ecosystem, known as the Extended Internet of Things (XIoT), encompass various domains, including Industrial IoT (IIoT), Internet of Medical Things (IoMT), Internet of Vehicles (IoV), and Internet of Battlefield Things (IoBT). This interconnected ecosystem enhances automation and intelligence across industries while also increasing exposure to sophisticated malware threats. Traditional malware detection methods, such as signature-based and heuristic-based techniques, often fail to address evolving threats due to their limited ability to detect complex and dynamic behaviors. In response, deep learning has emerged as a transformative solution offering advanced capabilities for recognizing complex and dynamic malware behaviors. This paper presents a comprehensive survey of deep learning-based malware detection techniques across XIoT domains and introduces a novel cross-domain taxonomy that organizes existing work according to XIoT domains, operating systems, extracted features, and deep learning models. We critically examine state-of-the-art methods, analyzing their strengths, technical limitations, model complexity, and deployment feasibility. Furthermore, we identify significant research gaps and propose future directions to address key challenges, including dataset scarcity, computational overhead, and the lack of standardized cross-domain evaluation. This survey aims to serve as a foundational resource for advancing cybersecurity solutions within the rapidly expanding XIoT landscape.