A multi-architecture dataset for IoT malware detection using opcodes and system calls

Existing work on IoT malware is limited in architectural coverage, typically restricted to one or two CPU families, and rarely provides more than one feature type. This makes controlled, cross-feature comparison across the heterogeneous CPU ecosystem of real IoT deployments difficult to conduct. This paper addresses that gap by presenting a large-scale collection of derived feature vectors extracted from over 46,000 IoT malware binaries and thousands of benign samples across eight CPU architectures: x86-64, 80386, ARM, MIPS, MIPSEL, and the first behavioural analysis of PowerPC, SPARC, and m68k. For each binary, three feature representations are provided: static opcode counts extracted via disassembly, dynamic opcode counts captured via QEMU runtime tracing, and dynamic system-call counts recorded using strace. Samples are hash matched enabling strict like for like comparison on identical executables across all three feature sets. The dataset is structured into four evaluation configurations: single-feature, pairwise matched, three-way matched, and external honeypot validation using previously unseen real-world IoT malware. To our knowledge, this is the first dataset to provide all three behavioural feature types across eight IoT CPU architectures with hash matched like for like comparison.