{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T09:35:42Z","timestamp":1772357742718,"version":"3.50.1"},"reference-count":58,"publisher":"Association for Computing Machinery (ACM)","issue":"5s","license":[{"start":{"date-parts":[[2023,9,9]],"date-time":"2023-09-09T00:00:00Z","timestamp":1694217600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"IIT Palakkad Technology IHub Foundation Technology Development","award":["IPTIF\/ TD\/IP\/002"],"award-info":[{"award-number":["IPTIF\/ TD\/IP\/002"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Embed. Comput. Syst."],"published-print":{"date-parts":[[2023,10,31]]},"abstract":"<jats:p>There has been a tremendous growth of edge devices connected to the network in recent years. Although these devices make our life simpler and smarter, they need to perform computations under severe resource and energy constraints, while being vulnerable to malware attacks. Once compromised, these devices are further exploited as attack vectors targeting critical infrastructure. Most existing malware detection solutions are resource and compute-intensive and hence perform poorly in protecting edge devices. In this paper, we propose a novel approach ViT4Mal that utilizes a lightweight vision transformer (ViT) for malware detection on an edge device. ViT4Mal first converts executable byte-code into images to learn malware features and later uses a customized lightweight ViT to detect malware with high accuracy. We have performed extensive experiments to compare our model with state-of-the-art CNNs in the malware detection domain. Experimental results corroborate that ViTs don\u2019t demand deeper networks to achieve comparable accuracy of around 97% corresponding to heavily structured CNN models. We have also performed hardware deployment of our proposed lightweight ViT4Mal model on the Xilinx PYNQ Z1 FPGA board by applying specialized hardware optimizations such as quantization, loop pipelining, and array partitioning. ViT4Mal achieved an accuracy of ~94% and a 41x speedup compared to the original ViT model.<\/jats:p>","DOI":"10.1145\/3609112","type":"journal-article","created":{"date-parts":[[2023,9,9]],"date-time":"2023-09-09T13:33:18Z","timestamp":1694266398000},"page":"1-26","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":31,"title":["ViT4Mal: Lightweight Vision Transformer for Malware Detection on Edge Devices"],"prefix":"10.1145","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-1470-6476","authenticated-orcid":false,"given":"Akshara","family":"Ravi","sequence":"first","affiliation":[{"name":"Indian Institute of Technology Palakkad, India"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1358-0107","authenticated-orcid":false,"given":"Vivek","family":"Chaturvedi","sequence":"additional","affiliation":[{"name":"Indian Institute of Technology Palakkad, India"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2607-8135","authenticated-orcid":false,"given":"Muhammad","family":"Shafique","sequence":"additional","affiliation":[{"name":"New York University Abu Dhabi (NYUAD), United Arab Emirates"}]}],"member":"320","published-online":{"date-parts":[[2023,9,9]]},"reference":[{"key":"e_1_3_1_2_2","article-title":"Quantifying attention flow in transformers","author":"Abnar Samira","year":"2020","unstructured":"Samira Abnar and Willem Zuidema. 2020. Quantifying attention flow in transformers. arXiv preprint (2020). arXiv:2005.00928","journal-title":"arXiv preprint"},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2018.8433203"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.24018\/ejeng.2021.6.3.2372"},{"key":"e_1_3_1_5_2","volume-title":"Malware","year":"2022","unstructured":"Av-TEST. 2022. Malware. Retrieved November 2, 2022 from https:\/\/www.av-test.org\/en\/statistics\/malware\/"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSUSC.2018.2809665"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1049\/iet-ifs.2019.0159"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.3390\/rs13030516"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2015.7346821"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1080\/01969722.2021.2020471"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1504\/IJESDF.2007.016865"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2021.08.224"},{"key":"e_1_3_1_13_2","volume-title":"IoT Trends to Keep an Eye on in 2023 and Beyond","author":"Coughlin Tom","year":"2023","unstructured":"Tom Coughlin. 2023. IoT Trends to Keep an Eye on in 2023 and Beyond. Retrieved March 13, 2023 from https:\/\/www.techtarget.com\/iotagenda\/opinion\/IoT-trends-to-keep-an-eye-on"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-015-0261-z"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102846"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2022.3216818"},{"key":"e_1_3_1_17_2","volume-title":"PYNQ-Z1 Reference Manual","year":"2016","unstructured":"DIGILENT. 2016. PYNQ-Z1 Reference Manual. Retrieved April 28, 2022 from https:\/\/digilent.com\/reference\/programmable-logic\/pynq-z1\/reference-manual"},{"key":"e_1_3_1_18_2","article-title":"An image is worth 16x16 words: Transformers for image recognition at scale","author":"Dosovitskiy Alexey","year":"2020","unstructured":"Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et\u00a0al. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint (2020). arXiv:2010.11929","journal-title":"arXiv preprint"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2021.115519"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-017-0673-3"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-018-0321-2"},{"key":"e_1_3_1_22_2","volume-title":"Packing Box","year":"2023","unstructured":"GitHub. 2023. Packing Box. Retrieved May 8, 2023 from https:\/\/github.com\/packing-box"},{"key":"e_1_3_1_23_2","article-title":"Gaussian error linear units (gelus)","author":"Hendrycks Dan","year":"2016","unstructured":"Dan Hendrycks and Kevin Gimpel. 2016. Gaussian error linear units (gelus). arXiv preprint (2016). arXiv:1606.08415","journal-title":"arXiv preprint"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/AsiaJCIS.2018.00023"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICICCT.2018.8473346"},{"key":"e_1_3_1_26_2","volume-title":"IOT \\(\\_\\) Malware \\(\\_\\) dataset \\(\\_\\) for Classification","year":"2021","unstructured":"Kaggle. 2021. IOT \\(\\_\\) Malware \\(\\_\\) dataset \\(\\_\\) for Classification. Retrieved March 12, 2022 from https:\/\/www.kaggle.com\/datasets\/anaselmasry\/iot-malware"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-017-0673-3"},{"key":"e_1_3_1_28_2","volume-title":"Hacked Cameras, DVRs Powered Today\u2019s Massive Internet Outage","author":"Krebs B","year":"2016","unstructured":"B Krebs. 2016. Hacked Cameras, DVRs Powered Today\u2019s Massive Internet Outage. Retrieved August 12, 2021 from https:\/\/krebsonsecurity.com\/2016\/10\/hacked-cameras-dvrs-powered-todays-massive-internet-outage\/"},{"key":"e_1_3_1_29_2","volume-title":"The Resilient Satori Botnet","author":"Labs Black Lotus","year":"2018","unstructured":"Black Lotus Labs. 2018. The Resilient Satori Botnet. Retrieved August 12, 2021 from https:\/\/blog.lumen.com\/the-resilient-satori-botnet"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2017.04.001"},{"key":"e_1_3_1_31_2","article-title":"Are sixteen heads really better than one?","volume":"32","author":"Michel Paul","year":"2019","unstructured":"Paul Michel, Omer Levy, and Graham Neubig. 2019. Are sixteen heads really better than one? Advances in Neural Information Processing Systems 32 (2019).","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICAIBD.2018.8396202"},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2020.102154"},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016908"},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2015.2507185"},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046689"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.icte.2020.04.005"},{"key":"e_1_3_1_38_2","first-page":"91","volume-title":"USENIX Security Symposium","author":"Oberheide Jon","year":"2008","unstructured":"Jon Oberheide, Evan Cooke, and Farnam Jahanian. 2008. CloudAV: N-version antivirus in the network cloud.. In USENIX Security Symposium. 91\u2013106."},{"key":"e_1_3_1_39_2","volume-title":"9th USENIX Workshop on Offensive Technologies (WOOT\u201915)","author":"Pa Yin Minn Pa","year":"2015","unstructured":"Yin Minn Pa Pa, Shogo Suzuki, Katsunari Yoshioka, Tsutomu Matsumoto, Takahiro Kasama, and Christian Rossow. 2015. IoTPOT: Analysing the rise of IoT compromises. In 9th USENIX Workshop on Offensive Technologies (WOOT\u201915)."},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICTAI.2013.53"},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485894"},{"key":"e_1_3_1_42_2","article-title":"Review on the security threats of Internet of Things","author":"Podder Prajoy","year":"2021","unstructured":"Prajoy Podder, M Mondal, Subrato Bharati, and Pinto Kumar Paul. 2021. Review on the security threats of Internet of Things. arXiv preprint (2021). arXiv:2101.05614","journal-title":"arXiv preprint"},{"key":"e_1_3_1_43_2","volume-title":"AWS IoT Greengrass and PYNQ","year":"2019","unstructured":"PYNQ. 2019. AWS IoT Greengrass and PYNQ. Retrieved May 24, 2023 from https:\/\/discuss.pynq.io\/t\/aws-iot-greengrass-and-pynq\/697"},{"key":"e_1_3_1_44_2","volume-title":"Why Transformers are Slowly Replacing CNNs in Computer Vision?","author":"Radhakrishnan Pranoy","year":"2021","unstructured":"Pranoy Radhakrishnan. 2021. Why Transformers are Slowly Replacing CNNs in Computer Vision? Retrieved February 25, 2022 from https:\/\/becominghuman.ai\/transformers-in-vision-e2e87b739feb"},{"key":"e_1_3_1_45_2","first-page":"12116","article-title":"Do vision transformers see like convolutional neural networks?","volume":"34","author":"Raghu Maithra","year":"2021","unstructured":"Maithra Raghu, Thomas Unterthiner, Simon Kornblith, Chiyuan Zhang, and Alexey Dosovitskiy. 2021. Do vision transformers see like convolutional neural networks? Advances in Neural Information Processing Systems 34 (2021), 12116\u201312128.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_46_2","article-title":"MalBERT: Using transformers for cybersecurity and malicious software detection","author":"Rahali Abir","year":"2021","unstructured":"Abir Rahali and Moulay A Akhloufi. 2021. MalBERT: Using transformers for cybersecurity and malicious software detection. arXiv preprint (2021). arXiv:2103.03806","journal-title":"arXiv preprint"},{"key":"e_1_3_1_47_2","volume-title":"Vision Transformers Shaping the Architecture of Computer Vision","author":"K Anjali Raja","year":"2022","unstructured":"Anjali Raja K. 2022. Vision Transformers Shaping the Architecture of Computer Vision. Retrieved March 20, 2022 from https:\/\/indiaai.gov.in\/article\/vision-transformers-shaping-the-architecture-of-computer-vision"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2021.102876"},{"key":"e_1_3_1_49_2","doi-asserted-by":"publisher","DOI":"10.3390\/app122110991"},{"key":"e_1_3_1_50_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3206445"},{"key":"e_1_3_1_51_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10115-011-0393-5"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2018.10315"},{"key":"e_1_3_1_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/3378448"},{"key":"e_1_3_1_54_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107138"},{"key":"e_1_3_1_55_2","article-title":"Attention is all you need","volume":"30","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in Neural Information Processing Systems 30 (2017).","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_56_2","volume-title":"VirusShare Malware Repository","year":"2023","unstructured":"VirusShare. 2023. VirusShare Malware Repository. Retrieved June 18, 2021 from https:\/\/virusshare.com\/"},{"key":"e_1_3_1_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2017.2687918"},{"key":"e_1_3_1_58_2","doi-asserted-by":"publisher","DOI":"10.2197\/ipsjjip.24.522"},{"key":"e_1_3_1_59_2","doi-asserted-by":"publisher","DOI":"10.5220\/0010968300003120"}],"container-title":["ACM Transactions on Embedded Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3609112","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3609112","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:48:58Z","timestamp":1750182538000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3609112"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,9]]},"references-count":58,"journal-issue":{"issue":"5s","published-print":{"date-parts":[[2023,10,31]]}},"alternative-id":["10.1145\/3609112"],"URL":"https:\/\/doi.org\/10.1145\/3609112","relation":{},"ISSN":["1539-9087","1558-3465"],"issn-type":[{"value":"1539-9087","type":"print"},{"value":"1558-3465","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,9,9]]},"assertion":[{"value":"2023-03-23","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-06-30","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-09-09","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}