Effective spam filtering plays a crucial role in enhancing user experience by sparing them from unwanted messages. This imperative underscores the importance of safeguarding email systems, prompting scholars across diverse fields to delve deeper into this subject. The primary objective of this research is to mitigate the disruptive effects of spam on email usage by introducing improved security measures compared to existing methods. This goal can be accomplished through the development of a novel spam filtering technique designed to prevent spam from infiltrating users’ inboxes. Consequently, a hybrid filtering approach that combines an information gain philter and a Wrapper Grey Wolf Optimizer feature selection algorithm with a Naive Bayes Classifier, is proposed, denoted as GWO-NBC. This research is rigorously tested using the WEKA software and the SPAMBASE dataset. Thorough performance evaluations demonstrated that the proposed approach surpasses existing solutions in terms of both security and accuracy.

Rapid growth in IoT devices has led to the creation of crucial cybersecurity threats since existing methods of malware detection which use signature matching and numerical feature analysis are incapable of capturing the contextual behavioral semantics of IoT attacks. The presented work proposes an innovative malware detection framework incorporating a pipeline of behavior-to-text transformation together with transformer-based Large Language Models (LLMs) to perform binary classification of IoT network traffic. Selected through the process of SHAP-based feature importance analysis, the numerical features of network flows from the initial set of 41 features are transformed into natural language descriptions, allowing encoder-based LLMs to capture the context of IoT traffic behavior. Four LLMs, including DistilBERT, BERT-base, RoBERTa, and DeBERTa, were fine-tuned and rigorously tested against four Deep Learning baselines, Neural Network, LSTM, BiLSTM, and CNN, and four Machine Learning baselines, Random Forest, XGBoost, LightGBM, and CatBoost, using the CIC-IoT-2023 dataset under three experimental setups: balanced classification, realistic imbalanced distribution, and unseen variant detection. Additionally, a four-class multi-class classification experiment and an ablation study were conducted to further validate the framework. On a balanced dataset consisting of 400,000 samples, BERT-base and RoBERTa achieved the highest F1-scores of 98.94% with precision above 99.96%. In the imbalanced case of 90% attack and 10% benign traffic, the precision of all models was equal to 99.99%. The framework attained an F1-score of 99.99% for unseen variant detection on a completely unseen Mirai botnet variant with zero false negatives. The four-class multi-class experiment achieved a Macro F1-score of 88.80%. Statistical analysis across three independent runs confirmed high result stability with standard deviations below 0.03%. SHAP analysis revealed that packet count, ACK flag number, and HTTPS indicator were the most discriminative features, while attention visualization confirmed token-level interpretability. All LLMs consistently outperformed all Deep Learning baselines, providing evidence for the effectiveness of the behavior-to-text transformation paradigm for IoT malware detection, while classical ML models achieved marginally higher F1-scores due to their efficiency with numerical features, providing evidence for the effectiveness of the behavior-to-text transformation paradigm for IoT malware detection.