The number of connected smart devices has increased significantly due to the Internet of Things' (IoT) rapid growth, which increases the attack surface for malware-based cyber threats. As IoT environments grow into critical applications, accurate malware classification has become crucial for enabling intelligent and autonomous cybersecurity solutions. This study presents a comparative analysis of four ensemble machine learning models—Random Forest, XGBoost, LightGBM, and CatBoost—for multiclass IoT malware classification, utilizing PCAP network traffic data collected from various ARM-based IoT devices.The study uses a subset of the CIC-YNU-IoTMal dataset, known as the PCAP subset, and applies a preprocessing strategy to improve data quality by eliminating duplicate records, irrelevant attributes, unidentified malware classes, and missing and infinite values . The performance of the chosen models was assessed in terms of accuracy, precision, recall, F1-score, and computational efficiency. Experimental results show that LightGBM obtained the highest classification accuracy of 84.23\%, the highest weighted precision of 80.28\%, recall of 84.23\%, and an F1-score of 80.12 \%. The results of this study show that ensemble learning methods can be a viable solution for network-based IoT malware classification and may be used as a component for intelligent decision-making in future AI-based Agentic cyber defense systems that can autonomously monitor, analyze, and react to threats.

Internet of Things (IoT), IoT Malware Classification, PCAP, Machine Learning, Ensemble Learning, LightGBM, XGBoost.