{"id":"https://openalex.org/W7164542980","doi":"https://doi.org/10.1145/3800506.3803517","title":"AUTOMal: An LLM-Based Automated Feature Engineering Framework for Efficient Malware Detection at the Edge","display_name":"AUTOMal: An LLM-Based Automated Feature Engineering Framework for Efficient Malware Detection at the Edge","publication_year":2026,"publication_date":"2026-06-12","ids":{"openalex":"https://openalex.org/W7164542980","doi":"https://doi.org/10.1145/3800506.3803517"},"language":null,"primary_location":{"id":"doi:10.1145/3800506.3803517","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3800506.3803517","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Sixteenth ACM Conference on Data and Application Security and Privacy","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3800506.3803517","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101751564","display_name":"Nguyen Khanh Son","orcid":"https://orcid.org/0000-0002-4173-687X"},"institutions":[{"id":"https://openalex.org/I115752224","display_name":"University of Insubria","ror":"https://ror.org/00s409261","country_code":"IT","type":"education","lineage":["https://openalex.org/I115752224"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Nguyen Khanh Son","raw_affiliation_strings":["University of Insubria, Varese, Italy"],"raw_orcid":"https://orcid.org/0009-0006-2133-0692","affiliations":[{"raw_affiliation_string":"University of Insubria, Varese, Italy","institution_ids":["https://openalex.org/I115752224"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059860066","display_name":"Christian Rondanini","orcid":"https://orcid.org/0000-0003-0719-5894"},"institutions":[{"id":"https://openalex.org/I115752224","display_name":"University of Insubria","ror":"https://ror.org/00s409261","country_code":"IT","type":"education","lineage":["https://openalex.org/I115752224"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Christian Rondanini","raw_affiliation_strings":["University of Insubria, Varese, Italy"],"raw_orcid":"https://orcid.org/0000-0003-0719-5894","affiliations":[{"raw_affiliation_string":"University of Insubria, Varese, Italy","institution_ids":["https://openalex.org/I115752224"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057684417","display_name":"Barbara Carminati","orcid":"https://orcid.org/0000-0002-7502-4731"},"institutions":[{"id":"https://openalex.org/I115752224","display_name":"University of Insubria","ror":"https://ror.org/00s409261","country_code":"IT","type":"education","lineage":["https://openalex.org/I115752224"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Barbara Carminati","raw_affiliation_strings":["University of Insubria, Varese, Italy"],"raw_orcid":"https://orcid.org/0000-0002-7502-4731","affiliations":[{"raw_affiliation_string":"University of Insubria, Varese, Italy","institution_ids":["https://openalex.org/I115752224"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5036362276","display_name":"Elena Ferrari","orcid":"https://orcid.org/0000-0002-7312-6769"},"institutions":[{"id":"https://openalex.org/I115752224","display_name":"University of Insubria","ror":"https://ror.org/00s409261","country_code":"IT","type":"education","lineage":["https://openalex.org/I115752224"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Elena Ferrari","raw_affiliation_strings":["University of insubria, Varese, Italy"],"raw_orcid":"https://orcid.org/0000-0002-7312-6769","affiliations":[{"raw_affiliation_string":"University of insubria, Varese, Italy","institution_ids":["https://openalex.org/I115752224"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I115752224"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"335","last_page":"348"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9772999882698059,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9772999882698059,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.00570000009611249,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.00139999995008111,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5561000108718872},{"id":"https://openalex.org/keywords/edge-detection","display_name":"Edge detection","score":0.3853999972343445},{"id":"https://openalex.org/keywords/enhanced-data-rates-for-gsm-evolution","display_name":"Enhanced Data Rates for GSM Evolution","score":0.3785000145435333},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.3682999908924103},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.32690000534057617},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3012999892234802}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6499999761581421},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5561000108718872},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4336000084877014},{"id":"https://openalex.org/C193536780","wikidata":"https://www.wikidata.org/wiki/Q1513153","display_name":"Edge detection","level":4,"score":0.3853999972343445},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.3785000145435333},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3682999908924103},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3490999937057495},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.32690000534057617},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3012999892234802},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.2818000018596649},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2639000117778778},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.2605000138282776},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2590000033378601}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3800506.3803517","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3800506.3803517","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Sixteenth ACM Conference on Data and Application Security and Privacy","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3800506.3803517","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3800506.3803517","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Sixteenth ACM Conference on Data and Application Security and Privacy","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":29,"referenced_works":["https://openalex.org/W2584335703","https://openalex.org/W2584781382","https://openalex.org/W2977715335","https://openalex.org/W3006325478","https://openalex.org/W3009186105","https://openalex.org/W3164964481","https://openalex.org/W3191884578","https://openalex.org/W3194214662","https://openalex.org/W3202428668","https://openalex.org/W3210668460","https://openalex.org/W4205678345","https://openalex.org/W4226319939","https://openalex.org/W4281659734","https://openalex.org/W4288083802","https://openalex.org/W4311484473","https://openalex.org/W4322730960","https://openalex.org/W4388782207","https://openalex.org/W4390603899","https://openalex.org/W4390692489","https://openalex.org/W4391136507","https://openalex.org/W4399615703","https://openalex.org/W4405865604","https://openalex.org/W4407844694","https://openalex.org/W4409036096","https://openalex.org/W4411870410","https://openalex.org/W4414409924","https://openalex.org/W6963881321","https://openalex.org/W7133188930","https://openalex.org/W7133192941"],"related_works":[],"abstract_inverted_index":{"Edge":[0],"computing":[1],"supports":[2],"real-time":[3],"decision":[4],"making":[5],"and":[6,20,73,94],"is":[7,29,74],"crucial":[8],"for":[9,37,113,133],"applications":[10],"such":[11],"as":[12,66],"the":[13,41,50,141,148,161],"Internet":[14],"of":[15,130,140],"Things":[16],"(IoT),":[17],"autonomous":[18],"systems,":[19],"smart":[21],"manufacturing.":[22],"Securing":[23],"these":[24],"devices":[25],"against":[26],"malware":[27,38,115,157],"attacks":[28],"essential.":[30],"Many":[31],"machine":[32],"learning":[33],"(ML)":[34],"based":[35],"approaches":[36],"detection":[39,116,158],"at":[40,49],"edge":[42],"have":[43],"been":[44],"developed":[45],"so":[46],"far.":[47],"However,":[48],"initial":[51],"stage,":[52],"extracting":[53],"features":[54,131],"from":[55],"raw":[56],"data":[57],"to":[58,85,90,127,179],"train":[59],"ML":[60],"models":[61],"remains":[62],"a":[63,107,164],"significant":[64],"challenge,":[65],"it":[67],"often":[68,83],"requires":[69],"substantial":[70,165],"domain":[71,87,119],"expertise":[72],"time-consuming.":[75],"Existing":[76],"automated":[77,109],"frameworks":[78],"using":[79],"traditional":[80],"transformation":[81,139],"techniques":[82],"fail":[84],"incorporate":[86],"knowledge,":[88],"attempt":[89],"transform":[91],"all":[92],"features,":[93],"frequently":[95],"spend":[96],"excessive":[97],"time":[98],"processing":[99,176],"unnecessary":[100],"ones.":[101],"In":[102],"this":[103],"paper,":[104],"we":[105],"introduce":[106],"novel":[108],"feature":[110],"engineering":[111],"framework":[112,150,162],"ML-based":[114],"that":[117,147],"exploits":[118],"knowledge":[120],"encoded":[121],"in":[122,167,175],"Large":[123],"Language":[124],"Models":[125],"(LLMs)":[126],"identify":[128],"subsets":[129],"appropriate":[132],"specific":[134],"transformations,":[135],"thereby":[136],"avoiding":[137],"indiscriminate":[138],"entire":[142],"dataset.":[143],"Experimental":[144],"results":[145],"demonstrate":[146],"proposed":[149],"outperforms":[151],"state-of-the-art":[152],"methods":[153],"on":[154],"multiple":[155],"IoT":[156],"datasets.":[159],"Moreover,":[160],"achieves":[163],"reduction":[166],"computational":[168],"overhead,":[169],"exhibiting":[170],"an":[171],"approximate":[172],"90-fold":[173],"improvement":[174],"efficiency":[177],"relative":[178],"existing":[180],"approaches.":[181]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-06-13T00:00:00"}