{"id":"https://openalex.org/W7163138670","doi":"https://doi.org/10.1145/3812836.3814750","title":"SemantiGuard: Intent-Aware Malicious Code Detection for IoT Agent Systems","display_name":"SemantiGuard: Intent-Aware Malicious Code Detection for IoT Agent Systems","publication_year":2026,"publication_date":"2026-06-02","ids":{"openalex":"https://openalex.org/W7163138670","doi":"https://doi.org/10.1145/3812836.3814750"},"language":null,"primary_location":{"id":"doi:10.1145/3812836.3814750","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3812836.3814750","pdf_url":null,"source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th Annual International Conference on Mobile Systems, Applications and Services Workshops","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3812836.3814750","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5052527931","display_name":"Shangru Zhao","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shangru Zhao","raw_affiliation_strings":["University of Chinese Academy of Sciences, Beijing, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0009-1883-7750","affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences, Beijing, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137663070","display_name":"Yuxue Wu","orcid":"https://orcid.org/0009-0007-9665-519X"},"institutions":[{"id":"https://openalex.org/I39333907","display_name":"Yanshan University","ror":"https://ror.org/02txfnf15","country_code":"CN","type":"education","lineage":["https://openalex.org/I39333907"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuxue Wu","raw_affiliation_strings":["Yanshan University, Qinhuangdao, Hebei, China"],"raw_orcid":"https://orcid.org/0009-0007-9665-519X","affiliations":[{"raw_affiliation_string":"Yanshan University, Qinhuangdao, Hebei, China","institution_ids":["https://openalex.org/I39333907"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5076473267","display_name":"Y Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuqing Zhang","raw_affiliation_strings":["University of Chinese Academy of Sciences, Beijing, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-8306-7195","affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences, Beijing, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.8938265,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"166","last_page":"171"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.7760000228881836,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.7760000228881836,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.08299999684095383,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.018699999898672104,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.4293000102043152},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.38690000772476196},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.349700003862381},{"id":"https://openalex.org/keywords/multi-agent-system","display_name":"Multi-agent system","score":0.3336000144481659},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.31779998540878296}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5964000225067139},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4293000102043152},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.4293000102043152},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.38690000772476196},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.349700003862381},{"id":"https://openalex.org/C41550386","wikidata":"https://www.wikidata.org/wiki/Q529909","display_name":"Multi-agent system","level":2,"score":0.3336000144481659},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.31779998540878296},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.24379999935626984},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.23749999701976776},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.23399999737739563}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3812836.3814750","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3812836.3814750","pdf_url":null,"source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th Annual International Conference on Mobile Systems, Applications and Services Workshops","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3812836.3814750","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3812836.3814750","pdf_url":null,"source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th Annual International Conference on Mobile Systems, Applications and Services Workshops","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":7,"referenced_works":["https://openalex.org/W2508433864","https://openalex.org/W4389159189","https://openalex.org/W4399667970","https://openalex.org/W4402350363","https://openalex.org/W4407236106","https://openalex.org/W4410815357","https://openalex.org/W4414437166"],"related_works":[],"abstract_inverted_index":{"The":[0],"paradigm":[1],"of":[2,150],"cloud-edge":[3,213],"collaboration":[4],"has":[5,32],"fundamentally":[6],"reshaped":[7],"distributed":[8],"computing,":[9],"enabling":[10],"resource-constrained":[11],"edge":[12,40],"devices":[13],"to":[14,23,35,51,64,99,134,195],"offload":[15],"complex":[16],"reasoning,":[17],"orchestration,":[18],"and":[19,45,60,93,110,147,164,172],"code":[20,44,83,90,137],"generation":[21],"tasks":[22,163],"highly":[24],"capable":[25],"cloud-based":[26],"Large":[27],"Language":[28],"Models.":[29],"This":[30,56],"architecture":[31,57],"given":[33],"rise":[34],"autonomous":[36],"multi-agent":[37],"systems,":[38],"wherein":[39],"agents":[41],"dynamically":[42],"execute":[43],"instructions":[46,106],"formulated":[47],"by":[48,138],"cloud":[49,78],"servers":[50],"achieve":[52],"specific":[53],"user":[54],"goals.":[55],"offers":[58],"flexibility":[59],"offloads":[61],"heavy":[62],"computation":[63],"the":[65,85,111,117,143,148],"cloud,":[66],"but":[67],"it":[68],"also":[69],"introduces":[70],"new":[71],"security":[72,91,210],"risks:":[73],"a":[74,126,155,208],"compromised":[75],"or":[76],"adversarial":[77,166],"agent":[79,162,214],"can":[80],"inject":[81],"malicious":[82,105,136],"into":[84],"edge's":[86],"execution":[87],"stream.":[88],"Traditional":[89],"scanners":[92],"static":[94],"analysis":[95],"tools":[96],"often":[97],"fail":[98],"detect":[100,135],"such":[101],"threats,":[102],"especially":[103],"when":[104],"are":[107],"subtly":[108],"embedded,":[109],"code's":[112],"behavior":[113,149],"is":[114,207],"misaligned":[115],"with":[116],"user's":[118,144],"intent.":[119],"In":[120],"this":[121],"paper,":[122],"we":[123],"propose":[124],"SemantiGuard,":[125],"novel":[127],"approach":[128],"that":[129,204],"leverages":[130],"local,":[131],"tiny":[132],"LLMs":[133],"analyzing":[139],"semantic":[140],"mismatches":[141],"between":[142],"intended":[145],"task":[146],"generated":[151],"code.":[152],"We":[153],"build":[154],"benchmark":[156],"derived":[157],"from":[158,193],"eight":[159],"validated":[160],"smart-home":[161],"216":[165],"variants":[167],"spanning":[168],"nine":[169],"attack":[170],"categories":[171],"three":[173,177],"obfuscation":[174],"tiers.":[175],"Across":[176],"locally":[178],"served":[179],"models,":[180],"intent":[181],"conditioning":[182],"improves":[183],"malicious-sample":[184],"recall":[185,191],"on":[186,189],"all":[187],"three;":[188],"Qwen3-1.7B,":[190],"increases":[192],"68.5%":[194],"81.0%":[196],"while":[197],"maintaining":[198],"sub-second":[199],"latency.":[200],"These":[201],"results":[202],"suggest":[203],"intent-aware":[205],"verification":[206],"practical":[209],"primitive":[211],"for":[212],"systems.":[215]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-06-03T00:00:00"}