Malware Detection in Sensor Systems: Probability-Distribution Framework Versus Deep Learning : * Simulation-Based Analysis

The proliferation of Internet-of-Things (IoT) sensor systems has introduced unprecedented vulnerability to timing-based malware that subtly alters event inter-arrival statistics rather than packet payloads. Detecting these timing anomalies in real time is crucial yet challenging, given the constrained resources of edge devices and the limited availability of labeled data. This study introduces a unified statistical framework that models sensor inter-arrival times (IATs) using parametric probability distributions and integrates these models with sequential detectors such as cumulative sum (CUSUM) and generalized likelihood ratio (GLR) tests. Analytical control over false-alarm rates and detection delay is achieved through Kullback–Leibler (KL) divergence analysis and bootstrap-based threshold calibration using simulated data. The study compares this interpretable statistical approach with deep-learning (DL) baselines, including Transformer and long short-term memory (LSTM) anomaly forecasters. It demonstrates a hybrid design that combines both paradigms for high-accuracy, low-cost edge deployment. The approach is validated through theoretical derivations, manual examples, and Monte Carlo simulations benchmarked against deep models.