TOM-Net: Few-Shot IoT Malware Classification Via Open-Set Aware Transductive Meta-Learning

The proliferation of Internet of Things (IoT) devices has been paralleled by a surge in sophisticated malware threats, posing significant challenges to traditional security mechanisms. Conventional malware classification models often depend on extensive labeled datasets and exhibit limited generalization capabilities, particularly when encountering novel or cross-architecture malware variants. In this study, we introduce TOMNet, a transductive meta-learning framework that synergistically integrates few-shot learning with graph-based inference to facilitate efficient IoT malware classification under datascarce conditions. TOM-Net employs a hierarchical GraphSAGE encoder to extract both structural and semantic features from function call graphs, augmented with adaptive similarity kernels for transductive label propagation and entropy-regularized decision boundaries to enhance open-set recognition. Empirical evaluations demonstrate that TOM-Net achieves a classification accuracy of 92.64% in the 5-way 10-shot setting under the closed-set condition, and an area under the curve (AUC) of 93.59% in the open-set setting, significantly outperforming state-of-the-art baselines in detecting previously unseen threats. These results underscore the practical applicability of TOM-Net for robust IoT malware defense in scenarios characterized by limited labeled data.