With the widespread application of Internet of Things (IoT) devices and the deep integration of cyber systems with physical systems, power systems are gradually evolving towards Cyber-Physical Power System (CPPS). However, the proliferation of IoT devices has expanded the system’s attack surface, allowing malware to infiltrate and compromise CPPS operation. Therefore, it is imperative to conduct research on malware detection specifically for CPPS. Current detection methods, however, have certain limitations, such as difficulty in analyzing IoT malware across multiple CPU architectures and insufficient opcode feature extraction. To address these issues, this paper proposes a multi-CPU architecture IoT malware detection approach based on Intermediate Representation (IR). The approach consists of a binary lifting model, an IR deduplication model, and a deep learning classification model. The binary lifting model performs in-depth malware opcode analysis and outputs them as higher-level IR, facilitating malware processing across different CPU architectures. Due to significant redundancy in the IR output, an IR deduplication model is designed to optimize the IR, ensuring high-quality data input for the classification model. The deep learning classification model processes the deduplicated IR using word embedding techniques, employs a one-dimensional convolutional neural network (1D-CNN) for dimensionality reduction, and utilizes a Long Short-Term Memory (LSTM) network for malware classification. Experimental results demonstrate that the proposed IR-based multi-CPU architecture malware detection approach can more effectively identify and classify malware across different architectures, thereby enhancing detection accuracy.