Unsupervised correlation-based classification of IoT malware for consumer devices

Consumer Internet of Things (IoT) devices, including home routers, smart cameras, DVRs, and other embedded appliances, remain prime targets for botnet operators due to weak security postures, fragmented firmware ecosystems, and continuous Internet exposure. Compromised devices form large-scale botnets that threaten consumer electronics (CE) environments through DDoS attacks, credential brute-forcing, and rapid malware propagation. Existing detection frameworks typically rely on dynamic sandboxing or large labeled datasets, both of which introduce computational and operational overheads incompatible with consumer-edge deployments. This paper presents a lightweight cross-layer methodology that integrates honeypot logs with static ELF analysis to infer botnet families and campaign structures without requiring dynamic execution. Using a year-long deployment of a Cowrie SSH/Telnet honeypot emulating consumer IoT behavior, we analyze 14.2M log events and 140 malware binaries captured in the wild. Indicators of compromise extracted from ELF strings are correlated with URLs, IPs, and filenames observed in attacker sessions, yielding a 35.7% direct log-payload linkage. Compact embeddings derived from static attributes are clustered via unsupervised learning and interpreted using semi-supervised labeling, revealing eight well-separated malware groups (Silhouette = 0.835) including UPX-packed loaders, Mirai and Gafgyt variants, Mirai/Mozi hybrids, and emerging Go-based worms. Our results show that effective botnet intelligence for consumer IoT ecosystems can be achieved using scalable, explainable, static-only techniques suitable for home networks, ISP CPE devices, and edge security solutions.