{"id":"https://openalex.org/W4414575275","doi":"https://doi.org/10.1145/3769681","title":"Malware Detection at the Edge with Lightweight LLMs: A Performance Evaluation","display_name":"Malware Detection at the Edge with Lightweight LLMs: A Performance Evaluation","publication_year":2025,"publication_date":"2025-09-27","ids":{"openalex":"https://openalex.org/W4414575275","doi":"https://doi.org/10.1145/3769681"},"language":"en","primary_location":{"id":"doi:10.1145/3769681","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3769681","pdf_url":null,"source":{"id":"https://openalex.org/S97833917","display_name":"ACM Transactions on Internet Technology","issn_l":"1533-5399","issn":["1533-5399","1557-6051"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Internet Technology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3769681","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5059860066","display_name":"Christian Rondanini","orcid":"https://orcid.org/0000-0003-0719-5894"},"institutions":[{"id":"https://openalex.org/I115752224","display_name":"University of Insubria","ror":"https://ror.org/00s409261","country_code":"IT","type":"education","lineage":["https://openalex.org/I115752224"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Christian Rondanini","raw_affiliation_strings":["Dista, University of Insubria","Dista, University of Insubria, Varese, Italy"],"raw_orcid":"https://orcid.org/0000-0003-0719-5894","affiliations":[{"raw_affiliation_string":"Dista, University of Insubria","institution_ids":["https://openalex.org/I115752224"]},{"raw_affiliation_string":"Dista, University of Insubria, Varese, Italy","institution_ids":["https://openalex.org/I115752224"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057684417","display_name":"Barbara Carminati","orcid":"https://orcid.org/0000-0002-7502-4731"},"institutions":[{"id":"https://openalex.org/I115752224","display_name":"University of Insubria","ror":"https://ror.org/00s409261","country_code":"IT","type":"education","lineage":["https://openalex.org/I115752224"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Barbara Carminati","raw_affiliation_strings":["DiSTA, University of Insubria","DiSTA, University of Insubria, Varese, Italy"],"raw_orcid":"https://orcid.org/0000-0002-7502-4731","affiliations":[{"raw_affiliation_string":"DiSTA, University of Insubria","institution_ids":["https://openalex.org/I115752224"]},{"raw_affiliation_string":"DiSTA, University of Insubria, Varese, Italy","institution_ids":["https://openalex.org/I115752224"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036362276","display_name":"Elena Ferrari","orcid":"https://orcid.org/0000-0002-7312-6769"},"institutions":[{"id":"https://openalex.org/I115752224","display_name":"University of Insubria","ror":"https://ror.org/00s409261","country_code":"IT","type":"education","lineage":["https://openalex.org/I115752224"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Elena Ferrari","raw_affiliation_strings":["DiSTA, Universita degli Studi dell'Insubria Dipartimento di Scienze Teoriche e Applicate","DiSTA, Universita degli Studi dell'Insubria Dipartimento di Scienze Teoriche e Applicate, Varese, Italy"],"raw_orcid":"https://orcid.org/0000-0002-7312-6769","affiliations":[{"raw_affiliation_string":"DiSTA, Universita degli Studi dell'Insubria Dipartimento di Scienze Teoriche e Applicate","institution_ids":["https://openalex.org/I115752224"]},{"raw_affiliation_string":"DiSTA, Universita degli Studi dell'Insubria Dipartimento di Scienze Teoriche e Applicate, Varese, Italy","institution_ids":["https://openalex.org/I115752224"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032325271","display_name":"Ashish Kundu","orcid":"https://orcid.org/0000-0003-1499-5558"},"institutions":[{"id":"https://openalex.org/I135428043","display_name":"Cisco Systems (United States)","ror":"https://ror.org/03yt1ez60","country_code":"US","type":"company","lineage":["https://openalex.org/I135428043"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ashish Kundu","raw_affiliation_strings":["Cisco Systems Inc","Cisco Systems Inc, San Jose, United States"],"raw_orcid":"https://orcid.org/0000-0003-1499-5558","affiliations":[{"raw_affiliation_string":"Cisco Systems Inc","institution_ids":["https://openalex.org/I135428043"]},{"raw_affiliation_string":"Cisco Systems Inc, San Jose, United States","institution_ids":["https://openalex.org/I135428043"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5119751494","display_name":"Antonio Gaudiano","orcid":null},"institutions":[{"id":"https://openalex.org/I115752224","display_name":"University of Insubria","ror":"https://ror.org/00s409261","country_code":"IT","type":"education","lineage":["https://openalex.org/I115752224"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Antonio Gaudiano","raw_affiliation_strings":["DiSTA, University of Insubria","DiSTA, University of Insubria, Varese, Italy"],"raw_orcid":"https://orcid.org/0009-0009-6233-2629","affiliations":[{"raw_affiliation_string":"DiSTA, University of Insubria","institution_ids":["https://openalex.org/I115752224"]},{"raw_affiliation_string":"DiSTA, University of Insubria, Varese, Italy","institution_ids":["https://openalex.org/I115752224"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":7.2195,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.97741395,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"26","issue":"1","first_page":"1","last_page":"24"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7900999784469604},{"id":"https://openalex.org/keywords/enhanced-data-rates-for-gsm-evolution","display_name":"Enhanced Data Rates for GSM Evolution","score":0.7700999975204468},{"id":"https://openalex.org/keywords/sophistication","display_name":"Sophistication","score":0.746399998664856},{"id":"https://openalex.org/keywords/edge-computing","display_name":"Edge computing","score":0.654699981212616},{"id":"https://openalex.org/keywords/edge-device","display_name":"Edge device","score":0.5393999814987183}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9039999842643738},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7900999784469604},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.7700999975204468},{"id":"https://openalex.org/C168725872","wikidata":"https://www.wikidata.org/wiki/Q991663","display_name":"Sophistication","level":2,"score":0.746399998664856},{"id":"https://openalex.org/C2778456923","wikidata":"https://www.wikidata.org/wiki/Q5337692","display_name":"Edge computing","level":3,"score":0.654699981212616},{"id":"https://openalex.org/C138236772","wikidata":"https://www.wikidata.org/wiki/Q25098575","display_name":"Edge device","level":3,"score":0.5393999814987183},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.421099990606308},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.384799987077713},{"id":"https://openalex.org/C193536780","wikidata":"https://www.wikidata.org/wiki/Q1513153","display_name":"Edge detection","level":4,"score":0.3203999996185303},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.30140000581741333},{"id":"https://openalex.org/C163258240","wikidata":"https://www.wikidata.org/wiki/Q25342","display_name":"Power (physics)","level":2,"score":0.2777000069618225},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.25540000200271606}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3769681","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3769681","pdf_url":null,"source":{"id":"https://openalex.org/S97833917","display_name":"ACM Transactions on Internet Technology","issn_l":"1533-5399","issn":["1533-5399","1557-6051"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Internet Technology","raw_type":"journal-article"},{"id":"pmh:oai:irinsubria.uninsubria.it:11383/2212931","is_oa":false,"landing_page_url":"https://hdl.handle.net/11383/2212931","pdf_url":null,"source":{"id":"https://openalex.org/S4377196351","display_name":"IrInSubria (University of Insubria)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I115752224","host_organization_name":"University of Insubria","host_organization_lineage":["https://openalex.org/I115752224"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1145/3769681","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3769681","pdf_url":null,"source":{"id":"https://openalex.org/S97833917","display_name":"ACM Transactions on Internet Technology","issn_l":"1533-5399","issn":["1533-5399","1557-6051"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Internet Technology","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":16,"referenced_works":["https://openalex.org/W2119821739","https://openalex.org/W2143426320","https://openalex.org/W2911964244","https://openalex.org/W2963026768","https://openalex.org/W3162956350","https://openalex.org/W3191884578","https://openalex.org/W4206569030","https://openalex.org/W4226319939","https://openalex.org/W4361004367","https://openalex.org/W4390692489","https://openalex.org/W4391582407","https://openalex.org/W4402350363","https://openalex.org/W4403628430","https://openalex.org/W4405103929","https://openalex.org/W4406458670","https://openalex.org/W4411487126"],"related_works":[],"abstract_inverted_index":{"The":[0],"rapid":[1],"evolution":[2],"of":[3,10,103],"malware":[4,47,53],"attacks":[5],"calls":[6],"for":[7,45,52,109,133],"the":[8,101,104],"development":[9],"innovative":[11],"detection":[12,20,54],"methods,":[13],"especially":[14],"in":[15,65],"resource-constrained":[16],"edge":[17,57,70,110,134,140],"computing.":[18],"Traditional":[19],"techniques":[21],"struggle":[22],"to":[23],"keep":[24],"up":[25],"with":[26,126,142],"modern":[27],"malware\u2019s":[28],"sophistication":[29],"and":[30,68,73,95,135,138,146],"adaptability,":[31],"prompting":[32],"a":[33],"shift":[34],"towards":[35],"advanced":[36],"methodologies":[37],"like":[38,92],"those":[39],"leveraging":[40,85],"Large":[41],"Language":[42],"Models":[43],"(LLMs)":[44],"enhanced":[46],"detection.":[48],"However,":[49],"deploying":[50],"LLMs":[51],"directly":[55],"at":[56],"devices":[58],"raises":[59],"several":[60,119,127],"challenges,":[61,79],"including":[62],"ensuring":[63],"accuracy":[64,94],"constrained":[66],"environments":[67],"addressing":[69,90],"devices\u2019":[71],"energy":[72],"computational":[74,97,144],"limits.":[75],"To":[76,99],"tackle":[77],"these":[78],"this":[80],"article":[81],"proposes":[82],"an":[83,114],"architecture":[84],"lightweight":[86,106,121],"LLMs\u2019":[87],"strengths":[88],"while":[89],"limitations":[91],"reduced":[93],"insufficient":[96],"power.":[98],"evaluate":[100],"effectiveness":[102],"proposed":[105],"LLM-based":[107],"approach":[108],"computing,":[111],"we":[112],"perform":[113],"extensive":[115],"experimental":[116],"evaluation":[117],"using":[118],"state-of-the-art":[120],"LLMs.":[122],"We":[123],"test":[124],"them":[125],"publicly":[128],"available":[129],"datasets":[130],"specifically":[131],"designed":[132],"IoT":[136],"scenarios,":[137],"different":[139],"nodes":[141],"varying":[143],"power":[145],"characteristics.":[147]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":7}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}