{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T18:19:22Z","timestamp":1771611562381,"version":"3.50.1"},"reference-count":50,"publisher":"Association for Computing Machinery (ACM)","issue":"1","funder":[{"name":"Malware Detection for Edge-based Computing","award":["Id 88749009"],"award-info":[{"award-number":["Id 88749009"]}]},{"name":"SERICS project","award":["PE00000014"],"award-info":[{"award-number":["PE00000014"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"published-print":{"date-parts":[[2026,2,28]]},"abstract":"<jats:p>The rapid evolution of malware attacks calls for the development of innovative detection methods, especially in resource-constrained edge computing. Traditional detection techniques struggle to keep up with modern malware\u2019s sophistication and adaptability, prompting a shift towards advanced methodologies like those leveraging Large Language Models (LLMs) for enhanced malware detection. However, deploying LLMs for malware detection directly at edge devices raises several challenges, including ensuring accuracy in constrained environments and addressing edge devices\u2019 energy and computational limits. To tackle these challenges, this article proposes an architecture leveraging lightweight LLMs\u2019 strengths while addressing limitations like reduced accuracy and insufficient computational power. To evaluate the effectiveness of the proposed lightweight LLM-based approach for edge computing, we perform an extensive experimental evaluation using several state-of-the-art lightweight LLMs. We test them with several publicly available datasets specifically designed for edge and IoT scenarios, and different edge nodes with varying computational power and characteristics.<\/jats:p>","DOI":"10.1145\/3769681","type":"journal-article","created":{"date-parts":[[2025,9,27]],"date-time":"2025-09-27T11:14:31Z","timestamp":1758971671000},"page":"1-24","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["Malware Detection at the Edge with Lightweight LLMs: A Performance Evaluation"],"prefix":"10.1145","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0719-5894","authenticated-orcid":false,"given":"Christian","family":"Rondanini","sequence":"first","affiliation":[{"name":"Dista, University of Insubria","place":["Varese, Italy"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7502-4731","authenticated-orcid":false,"given":"Barbara","family":"Carminati","sequence":"additional","affiliation":[{"name":"DiSTA, University of Insubria","place":["Varese, Italy"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7312-6769","authenticated-orcid":false,"given":"Elena","family":"Ferrari","sequence":"additional","affiliation":[{"name":"DiSTA, Universita degli Studi dell'Insubria Dipartimento di Scienze Teoriche e Applicate","place":["Varese, Italy"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1499-5558","authenticated-orcid":false,"given":"Ashish","family":"Kundu","sequence":"additional","affiliation":[{"name":"Cisco Systems Inc","place":["San Jose, United States"]}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-6233-2629","authenticated-orcid":false,"given":"Antonio","family":"Gaudiano","sequence":"additional","affiliation":[{"name":"DiSTA, University of Insubria","place":["Varese, Italy"]}]}],"member":"320","published-online":{"date-parts":[[2026,1,15]]},"reference":[{"key":"e_1_3_3_2_2","volume-title":"International Conference on Security and Privacy in Communication Systems","author":"Aghaei Ehsan","year":"2022","unstructured":"Ehsan Aghaei, Xi Niu, Waseem Shadid, and Ehab Al-Shaer. 2022. Securebert: A domain-specific language model for cybersecurity. In International Conference on Security and Privacy in Communication Systems. Springer."},{"key":"e_1_3_3_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3102056"},{"key":"e_1_3_3_4_2","volume-title":"Pattern Recognition and Machine Learning","author":"Bishop Christopher M","year":"2006","unstructured":"Christopher M Bishop and Nasser M Nasrabadi. 2006. Pattern Recognition and Machine Learning. Springer."},{"key":"e_1_3_3_5_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"e_1_3_3_6_2","article-title":"Class-based n-gram models of natural language","author":"Brown Peter F","year":"1992","unstructured":"Peter F Brown, Vincent J Della Pietra, Peter V Desouza, Jennifer C Lai, and Robert L Mercer. 1992. Class-based n-gram models of natural language. Computational Linguistics 18, 4 (1992), 467\u2013480.","journal-title":"Computational Linguistics"},{"key":"e_1_3_3_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/3641289"},{"key":"e_1_3_3_8_2","unstructured":"Yuxuan Chen Rongpeng Li Xiaoxue Yu Zhifeng Zhao and Honggang Zhang. 2024. Adaptive layer splitting for wireless LLM inference in edge computing: A model-based reinforcement learning approach. arXiv:2406.02616. Retrieved from https:\/\/arxiv.org\/abs\/\/2406.02616"},{"key":"e_1_3_3_9_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1022627411411"},{"key":"e_1_3_3_10_2","unstructured":"Jacob Devlin Ming-Wei Chang Kenton Lee and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv:1810.04805. Retrieved from https:\/\/arxiv.org\/abs\/\/1810.04805"},{"key":"e_1_3_3_11_2","article-title":"The llama 3 herd of models","author":"Dubey Abhimanyu","year":"2024","unstructured":"Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et\u00a0al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3165809"},{"key":"e_1_3_3_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3363469"},{"key":"e_1_3_3_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/OJCOMS.2024.3456549"},{"key":"e_1_3_3_15_2","article-title":"The theory behind overfitting, cross validation, regularization, bagging, and boosting: Tutorial","author":"Ghojogh Benyamin","year":"2019","unstructured":"Benyamin Ghojogh and Mark Crowley. 2019. The theory behind overfitting, cross validation, regularization, bagging, and boosting: Tutorial. arXiv preprint arXiv:1905.12787 (2019).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_16_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1012487302797"},{"key":"e_1_3_3_17_2","article-title":"Universal language model fine-tuning for text classification","author":"Howard Jeremy","year":"2018","unstructured":"Jeremy Howard and Sebastian Ruder. 2018. Universal language model fine-tuning for text classification. arXiv preprint arXiv:1801.06146 (2018).","journal-title":"arXiv preprint"},{"issue":"2","key":"e_1_3_3_18_2","first-page":"3","article-title":"Lora: Low-rank adaptation of large language models.","volume":"1","author":"Hu Edward J","year":"2022","unstructured":"Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et\u00a0al. 2022. Lora: Low-rank adaptation of large language models. ICLR 1, 2 (2022), 3.","journal-title":"ICLR"},{"key":"e_1_3_3_19_2","article-title":"Tinybert: Distilling bert for natural language understanding","author":"Jiao Xiaoqi","year":"2019","unstructured":"Xiaoqi Jiao, Yichun Yin, Lifeng Shang, Xin Jiang, Xiao Chen, Linlin Li, Fang Wang, and Qun Liu. 2019. Tinybert: Distilling bert for natural language understanding. arXiv preprint arXiv:1909.10351 (2019).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_20_2","article-title":"An introduction to domain adaptation and transfer learning","author":"Kouw Wouter M","year":"2018","unstructured":"Wouter M Kouw and Marco Loog. 2018. An introduction to domain adaptation and transfer learning. arXiv preprint arXiv:1812.11806 (2018).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_21_2","article-title":"Decoupled weight decay regularization","author":"Loshchilov I","year":"2017","unstructured":"I Loshchilov. 2017. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101 (2017).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASRU.2011.6163930"},{"key":"e_1_3_3_23_2","article-title":"Large language models: A survey","author":"Minaee Shervin","year":"2024","unstructured":"Shervin Minaee, Tomas Mikolov, Narjes Nikzad, Meysam Chenaghlu, Richard Socher, Xavier Amatriain, and Jianfeng Gao. 2024. Large language models: A survey. arXiv preprint arXiv:2402.06196 (2024).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_24_2","doi-asserted-by":"publisher","unstructured":"Nour Moustafa. 2021. A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets. Sustainable Cities and Society 72 (2021) 102994. DOI:10.1016\/j.scs.2021.102994","DOI":"10.1016\/j.scs.2021.102994"},{"key":"e_1_3_3_25_2","doi-asserted-by":"publisher","DOI":"10.3390\/s23135941"},{"key":"e_1_3_3_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISMSIT63511.2024.10757249"},{"key":"e_1_3_3_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2024.3352100"},{"key":"e_1_3_3_28_2","volume-title":"Proceedings of ITASEC25 (Joint National Conference on Cybersecurity (ITASEC & SERICS))","author":"Panebianco Francesco","year":"2025","unstructured":"Francesco Panebianco, Andrea Isgr\u00f2, Stefano Longari, Stefano Zanero, and Michele Carminati. 2025. Guessing as a service: Large language models are not yet ready for vulnerability detection. In Proceedings of ITASEC25 (Joint National Conference on Cybersecurity (ITASEC & SERICS))."},{"key":"e_1_3_3_29_2","article-title":"Improving language understanding by generative pre-training","author":"Radford Alec","year":"2018","unstructured":"Alec Radford, Karthik Narasimhan, Tim Salimans, Ilya Sutskever, et\u00a0al. 2018. Improving language understanding by generative pre-training. Hayate-Lab (2018).","journal-title":"Hayate-Lab"},{"key":"e_1_3_3_30_2","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","author":"Raffel Colin","year":"2020","unstructured":"Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research 21, 140 (2020), 1\u201367.","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_3_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/SMC52423.2021.9659287"},{"key":"e_1_3_3_32_2","article-title":"Malbertv2: Code aware bert-based model for malware identification","author":"A Rahali, Abir and Akhloufi, Moulay","year":"2023","unstructured":"Rahali, Abir and Akhloufi, Moulay A. 2023. Malbertv2: Code aware bert-based model for malware identification. Big Data and Cognitive Computing 7, 2 (2023), 60.","journal-title":"Big Data and Cognitive Computing"},{"key":"e_1_3_3_33_2","doi-asserted-by":"publisher","DOI":"10.1145\/3609112"},{"key":"e_1_3_3_34_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPS-ISA62245.2024.00011"},{"key":"e_1_3_3_35_2","article-title":"Transfer learning in pre-trained large language models for malware detection based on system calls","author":"S\u00e1nchez Pedro Miguel S\u00e1nchez","year":"2024","unstructured":"Pedro Miguel S\u00e1nchez S\u00e1nchez, Alberto Huertas Celdr\u00e1n, G\u00e9r\u00f4me Bovet, and Gregorio Mart\u00ednez P\u00e9rez. 2024. Transfer learning in pre-trained large language models for malware detection based on system calls. arXiv preprint arXiv:2405.09318 (2024).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_36_2","article-title":"DistilBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter","author":"Sanh Victor","year":"2019","unstructured":"Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. 2019. DistilBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108 (2019).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510413"},{"key":"e_1_3_3_38_2","article-title":"Sequence to sequence learning with neural networks","author":"Sutskever Ilya","year":"2014","unstructured":"Ilya Sutskever, Oriol Vinyals, and Quoc V Le. 2014. Sequence to sequence learning with neural networks. Advances in Neural Information Processing Systems (2014), 3104\u20133112.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_3_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/3530811"},{"key":"e_1_3_3_40_2","article-title":"Scale efficiently: Insights from pre-training and fine-tuning transformers","author":"Tay Yi","year":"2021","unstructured":"Yi Tay, Mostafa Dehghani, Jinfeng Rao, William Fedus, Samira Abnar, Hyung Won Chung, Sharan Narang, Dani Yogatama, Ashish Vaswani, and Donald Metzler. 2021. Scale efficiently: Insights from pre-training and fine-tuning transformers. arXiv preprint arXiv:2109.10686 (2021).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_41_2","doi-asserted-by":"publisher","DOI":"10.1111\/j.2517-6161.1996.tb02080.x"},{"key":"e_1_3_3_42_2","article-title":"Llama: Open and efficient foundation language models","author":"Touvron Hugo","year":"2023","unstructured":"Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth\u00e9e Lacroix, Baptiste Rozi\u00e8re, Naman Goyal, Eric Hambro, Faisal Azhar, et\u00a0al. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971 (2023).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_43_2","article-title":"Explainable malware detection system using transformers-based transfer learning and multi-model visual representation","author":"Ullah Farhan","year":"2022","unstructured":"Farhan Ullah, Amjad Alsirhani, Mohammed Mujib Alshahrani, Abdullah Alomari, Hamad Naeem, and Syed Aziz Shah. 2022. Explainable malware detection system using transformers-based transfer learning and multi-model visual representation. Sensors 22, 18 (2022), 6766.","journal-title":"Sensors"},{"key":"e_1_3_3_44_2","unstructured":"Ashish Vaswani Noam Shazeer Niki Parmar Jakob Uszkoreit Llion Jones Aidan N. Gomez Lukasz Kaiser and Illia Polosukhin. 2017. Attention is All you need. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017 December 4-9 2017 Isabelle Guyon Ulrike von Luxburg Samy Bengio Hanna M. Wallach Rob Fergus S. V. N. Vishwanathan and Roman Garnett (Eds.). Long Beach CA USA 5998\u20136008. Retrieved from https:\/\/proceedings.neurips.cc\/paper\/2017\/hash\/3f5ee243547dee91fbd053c1c4a845aa-Abstract.html"},{"key":"e_1_3_3_45_2","article-title":"Transformers: State-of-the-art natural language processing","author":"Wolf Thomas","year":"2020","unstructured":"Thomas Wolf. 2020. Transformers: State-of-the-art natural language processing. arXiv preprint arXiv:1910.03771 (2020).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_46_2","article-title":"A survey on knowledge distillation of large language models","author":"Xu Xiaohan","year":"2024","unstructured":"Xiaohan Xu, Ming Li, Chongyang Tao, Tao Shen, Reynold Cheng, Jinyang Li, Can Xu, Dacheng Tao, and Tianyi Zhou. 2024. A survey on knowledge distillation of large language models. arXiv preprint arXiv:2402.13116 (2024).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_47_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102458"},{"key":"e_1_3_3_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3649506"},{"key":"e_1_3_3_49_2","article-title":"EdgeShard: Efficient LLM inference via collaborative edge computing","author":"Zhang Mingjin","year":"2024","unstructured":"Mingjin Zhang, Jiannong Cao, Xiaoming Shen, and Zeyang Cui. 2024. EdgeShard: Efficient LLM inference via collaborative edge computing. arXiv preprint arXiv:2405.14371 (2024).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_50_2","article-title":"AppPoet: Large language model based android malware detection via multi-view prompt engineering","author":"Zhao Wenxiang","year":"2024","unstructured":"Wenxiang Zhao, Juntao Wu, and Zhaoyi Meng. 2024. AppPoet: Large language model based android malware detection via multi-view prompt engineering. arXiv preprint arXiv:2404.18816 (2024).","journal-title":"arXiv preprint"},{"key":"e_1_3_3_51_2","article-title":"A survey of large language models","author":"Zhao Wayne Xin","year":"2023","unstructured":"Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, et\u00a0al. 2023. A survey of large language models. arXiv preprint arXiv:2303.18223 (2023).","journal-title":"arXiv preprint"}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3769681","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,16]],"date-time":"2026-01-16T05:08:18Z","timestamp":1768540098000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3769681"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,15]]},"references-count":50,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2026,2,28]]}},"alternative-id":["10.1145\/3769681"],"URL":"https:\/\/doi.org\/10.1145\/3769681","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"value":"1533-5399","type":"print"},{"value":"1557-6051","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,15]]},"assertion":[{"value":"2025-02-14","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-07-02","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-01-15","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}