{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T22:59:49Z","timestamp":1783551589850,"version":"3.55.0"},"reference-count":33,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T00:00:00Z","timestamp":1767916800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>As edge computing becomes increasingly central to modern digital infrastructure, it also creates opportunities for sophisticated malware attacks that traditional security systems struggle to address. This study proposes a natural language processing (NLP) framework integrated with ensemble learning into next-generation firewalls (NGFWs) to detect and mitigate malware attacks in edge computing environments. The approach leverages unstructured threat intelligence (e.g., cybersecurity reports, logs) by applying NLP techniques, such as TF-IDF vectorization, to convert textual data into structured insights. This process uncovers hidden patterns and entity relationships within system logs. By combining Random Forest (RF) and Logistic Regression (LR) in a soft voting ensemble, the proposed model achieves 95% accuracy on a cyber threat intelligence dataset augmented with synthetic data to address class imbalance, and 98% accuracy on the CSE-CIC-IDS2018 dataset. The study was validated using ANOVA to assess statistical robustness and confusion matrix analysis, both of which confirmed low error rates. The system enhances detection rates and adaptability, providing a scalable defense layer optimized for resource-constrained, latency-sensitive edge environments.<\/jats:p>","DOI":"10.3390\/s26020424","type":"journal-article","created":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T08:09:06Z","timestamp":1767946146000},"page":"424","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Integrating NLP and Ensemble Learning into Next-Generation Firewalls for Robust Malware Detection in Edge Computing"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8012-9909","authenticated-orcid":false,"given":"Ramahlapane Lerato","family":"Moila","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of Limpopo, Polokwane 0727, South Africa"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1619-7429","authenticated-orcid":false,"given":"Mthulisi","family":"Velempini","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Limpopo, Polokwane 0727, South Africa"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,1,9]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Mohamed, N. (2024, January 24\u201328). A comprehensive review of natural language processing techniques for malware detection. Proceedings of the 15th International Conference on Computing Communication and Networking Technologies (ICCCNT), Kamand, India.","DOI":"10.1109\/ICCCNT61001.2024.10724079"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"28","DOI":"10.26565\/2519-2310-2023-1-02","article-title":"A short survey of the capabilities of next-generation firewalls","volume":"1","author":"Sichkar","year":"2023","journal-title":"Comput. Sci. Cybersecur."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"109560","DOI":"10.1016\/j.engappai.2024.109560","article-title":"A deep learning ensemble approach for malware detection in Internet of Things utilizing explainable artificial intelligence","volume":"139","author":"Mittal","year":"2025","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"1829","DOI":"10.22214\/ijraset.2024.61893","article-title":"A robust approach to malware detection through ensemble learning","volume":"12","year":"2024","journal-title":"Int. J. Res. Appl. Sci. Eng. Technol."},{"key":"ref_5","first-page":"135","article-title":"The role of next-generation firewalls in modern network security: A comprehensive analysis","volume":"15","author":"Patel","year":"2024","journal-title":"Int. J. Adv. Res. Eng. Technol."},{"key":"ref_6","first-page":"1","article-title":"AI-enabled approach for enhancing obfuscated malware detection: A hybrid ensemble learning with combined feature selection techniques","volume":"1","author":"Hossain","year":"2024","journal-title":"Int. J. Syst. Assur. Eng. Manag."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Zhukabayeva, T., Zholshiyeva, L., Karabayev, N., Khan, S., and Alnazzawi, N. (2025). Cybersecurity solutions for industrial internet of things\u2013edge computing integration: Challenges, threats, and future directions. Sensors, 25.","DOI":"10.3390\/s25010213"},{"key":"ref_8","unstructured":"Blessing, E., and Ademola, F. (2024). Scalability and resource efficiency of next-gen AI-based firewalls: A case study on cloud environments. HAL, hal-04972078."},{"key":"ref_9","unstructured":"Akinsowon, T., and Jiang, H. (2024). Leveraging Large Language Models for Behavior-Based Malware Detection Using Deep Learning, Sam Houston State University, Institute for Homeland Security. Report No. IHS\/CR-2024-1035."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Silvestri, S., Islam, S., Papastergiou, S., Tzagkarakis, C., and Ciampi, M. (2023). A machine learning approach for the NLP-based analysis of cyber threats and vulnerabilities of the healthcare ecosystem. Sensors, 23.","DOI":"10.3390\/s23020651"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Alanazi, F. (2023). A systematic literature review of autonomous and connected vehicles in traffic management. Appl. Sci., 13.","DOI":"10.3390\/app13031789"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Nie, S., Ren, J., Wu, R., Han, P., Han, Z., and Wan, W. (2025). Zero-trust access control mechanism based on blockchain and inner-product encryption on the internet of things in a 6G environment. Sensors, 25.","DOI":"10.3390\/s25020550"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"983","DOI":"10.1109\/TCC.2025.3583414","article-title":"Enhancing Container Security Through Phase-Based System Call Filtering","volume":"13","author":"Chen","year":"2025","journal-title":"IEEE Trans. Cloud Comput."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"3715086","DOI":"10.1155\/int\/3715086","article-title":"A resilience recovery method for complex traffic network security based on trend forecasting","volume":"2025","author":"Hong","year":"2025","journal-title":"Int. J. Intell. Syst."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"189","DOI":"10.1109\/MNET.2023.3329366","article-title":"An Efficient Incentive Mechanism for Federated Learning in Vehicular Networks","volume":"38","author":"Qiao","year":"2024","journal-title":"IEEE Netw."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"10462","DOI":"10.1109\/JIOT.2023.3238658","article-title":"Do Not Trust the Clouds Easily: The Insecurity of Content Security Policy Based on Object Storage","volume":"10","author":"Lv","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"215","DOI":"10.1109\/MNET.011.2000467","article-title":"AutoD: Intelligent Blockchain Application Unpacking Based on JNI Layer Deception Call","volume":"35","author":"Lu","year":"2021","journal-title":"IEEE Netw."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"282","DOI":"10.1109\/MNET.2024.3414113","article-title":"Recognizing BGP Communities Based on Graph Neural Network","volume":"38","author":"Tan","year":"2024","journal-title":"IEEE Netw."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"921","DOI":"10.1109\/TNSE.2020.2996738","article-title":"Gradient Shielding: Towards Understanding Vulnerability of Deep Neural Networks","volume":"8","author":"Gu","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"104222","DOI":"10.1016\/j.cose.2024.104222","article-title":"Cyberattack event logs classification using deep learning with semantic feature analysis","volume":"150","author":"Darwish","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_21","unstructured":"Golczynski, A., and Emanuello, A. (2021). End-to-end anomaly detection for identifying malicious cyber behavior through NLP-based log embeddings. arXiv."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Qiao, Z., Zhang, C., and Du, G. (2023, January 8\u20139). Improving Cybersecurity Named Entity Recognition with Large Language Models. Proceedings of the 6th International Conference on Signal Processing and Information Security (ICSPIS), Dubai, United Arab Emirates.","DOI":"10.1109\/CSECS60003.2023.10428218"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"16757","DOI":"10.1038\/s41598-025-01052-9","article-title":"Leveraging stacking machine learning models and optimization for improved cyberattack detection","volume":"15","author":"Pramanick","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Saeed, S., Suayyid, S.A., Al-Ghamdi, M.S., Al-Muhaisen, H., and Almuhaideb, A.M. (2023). A systematic literature review on Cyber threat intelligence for organizational cybersecurity resilience. Sensors, 23.","DOI":"10.3390\/s23167273"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1016\/j.procs.2021.05.077","article-title":"Phishing e-mail detection using natural language processing techniques: A literature survey","volume":"189","author":"Salloum","year":"2021","journal-title":"Procedia Comput. Sci."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"81736","DOI":"10.1109\/ACCESS.2024.3410046","article-title":"Edge-federated learning-based intelligent intrusion detection system for heterogeneous internet of things","volume":"12","author":"Mahadik","year":"2024","journal-title":"IEEE Access"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Yakubov, D., and H\u00e4stbacka, D. (2025, January 20\u201321). Comparative analysis of lightweight Kubernetes distributions for edge computing: Security, resilience, and maintainability. Proceedings of the European Conference on Service-Oriented and Cloud Computing (ESOCC), Bolzano, Italy.","DOI":"10.1007\/978-3-031-84617-5_8"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Kazi, M.A. (2025). Detecting malware cc communication traffic using artificial intelligence techniques. J. Cybersecur. Priv., 5.","DOI":"10.3390\/jcp5010004"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"833","DOI":"10.1016\/j.ins.2022.12.088","article-title":"Federated learning in smart cities: Privacy and security survey","volume":"632","author":"Li","year":"2023","journal-title":"Inf. Sci."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"102164","DOI":"10.1016\/j.jksuci.2024.102164","article-title":"Systematic review of deep learning solutions for malware detection and forensic analysis in IoT","volume":"36","author":"Qureshi","year":"2024","journal-title":"J. King Saud Univ. Comput. Inf. Sci."},{"key":"ref_31","unstructured":"Jeyavim Sherin, R.C., and Parkavi, K. (2023, January 14\u201315). Federated learning-based network intrusion detection using deep autoencoder. Proceedings of the 2023 6th International Conference on Recent Trends in Advanced Computing (ICRTAC), Chennai, India."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"140699","DOI":"10.1109\/ACCESS.2020.3013541","article-title":"Federated learning: A survey on enabling technologies, protocols, and applications","volume":"8","author":"Aledhari","year":"2020","journal-title":"IEEE Access"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1109\/MC.2017.9","article-title":"The Emergence of Edge Computing","volume":"50","author":"Satyanarayanan","year":"2017","journal-title":"Computer"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/2\/424\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T08:11:24Z","timestamp":1767946284000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/2\/424"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,9]]},"references-count":33,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2026,1]]}},"alternative-id":["s26020424"],"URL":"https:\/\/doi.org\/10.3390\/s26020424","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,9]]}}}