Shengli Pan

Deploying large language models (LLMs) directly at the edge offers significant benefits in reducing inference latency and enhancing privacy protection. However, this approach presents critical technical challenges due to the limited hardware resources available at the edge. In this paper, we explore the deployment of the Mixture-of-Experts (MoE) model, a popular LLM architecture, using weight quantization in a typical edge environment with multiple edge servers. Existing methods that uniformly quantize MoE models do not account for the varying importance of different experts or the dynamic nature of edge requests. To address these issues, we propose a hybrid expert quantization strategy, where each edge server quantizes experts to different bit-widths based on the preferences of received requests. Furthermore, we implement a comprehensive system optimization that jointly considers expert quantization and request assignment, aiming to achieve high-precision and low-latency inference services. To manage the complex, coupled optimization challenges, we design a reinforcement learning (RL)-based algorithm. To overcome the slow convergence typical of traditional RL, we pre-train the policy network using a system simulator that generates heuristic solutions, thus accelerating the learning process. Extensive experimental results on real datasets demonstrate that our approach significantly outperforms existing methods.

Binary malware summarization aims to automatically generate human-readable descriptions of malware behaviors from executable files, facilitating tasks like malware cracking and detection. Previous methods based on Large Language Models (LLMs) have shown great promise. However, they still face significant issues, including poor usability, inaccurate explanations, and incomplete summaries, primarily due to the obscure pseudocode structure and the lack of malware training summaries. Further, calling relationships between functions, which involve the rich interactions within a binary malware, remain largely underexplored. To this end, we propose MALSIGHT, a novel code summarization framework that can iteratively generate descriptions of binary malware by exploring malicious source code and benign pseudocode. Specifically, we construct the first malware summary dataset, MalS and MalP, using an LLM and manually refine this dataset with human effort. At the training stage, we tune our proposed MalT5, a novel LLM-based code model, on the MalS and benign pseudocode datasets. Then, at the test stage, we iteratively feed the pseudocode functions into MalT5 to obtain the summary. Such a procedure facilitates the understanding of pseudocode structure and captures the intricate interactions between functions, thereby benefiting summaries’ usability, accuracy, and completeness. Additionally, we propose a novel evaluation benchmark, BLEURT-sum, to measure the quality of summaries. Experiments on three datasets show the effectiveness of the proposed MALSIGHT. Notably, our proposed MalT5, with only 0.77B parameters, delivers comparable performance to much larger Code-Llama.

With the rapid expansion of IoT and the advent of the 6G era, ensuring efficient and secure communication for the edge large language model (LLM) servicing has become a critical priority. However, malicious relay nodes injecting delays pose a significant threat to network performance and security. This paper proposes a novel framework combining Stackelberg Game theory with Multi-Agent Reinforcement Learning (MARL) to mitigate communication delay injection attacks in edge networks. By modeling the interaction between edge devices and malicious nodes as a Stackelberg Game, where edge devices act as followers optimizing relay strategies and malicious nodes as leaders seeking disruption, our approach enables edge devices to cooperatively identify and avoid malicious nodes. The distributed MARL framework allows each edge device to learn their optimal strategies independently, enhancing network resilience. Experimental results demonstrate the effectiveness of our scheme in effectively reducing the impact of malicious nodes and improving the deployment capability of edge computing services.

This study addresses the side effect of the rapid development of the Internet, positioning botnets within digital ecosystems as a very serious potential threat to the Internet users. Malicious web robot might facilitate Web/data scraping, DDoS attacks, and data theft yielding serious cybersecurity threats. Modern botnets are advanced and have unique browser fingerprints, making their detection a real challenge. Traditional feature extraction methods heavily depend on expert knowledge. They also struggle with dimensional inconsistency when processing sessions of varying lengths, failing to counter evolving camouflage attacks. To approach such challenges, we propose Session2vec, a session representation framework based on multi-instance learning (MIL), which pioneers the MIL approach for Web session modeling. In this approach, we treat each request as an instance and the entire session as an instance collection, and then we use the FastText model to convert each URL request into a vector representation. Then, we utilize two innovative multi-instance aggregation methods: SARD (Session-level Aggregated Residual Descriptors) and SFAR (Session-level Fisher Aggregated Representation) to aggregate variable-length sessions into fixed-dimensional vectors capturing spatiotemporal features and distributional information within sessions. Simulation results of the proposed SARD and SFAR methods on public datasets show accuracy improvement of 5.2% and 16.3% on average, respectively, compared to state-of-the-art baselines. They also enhance F1 scores by 8.5% and 19.7%, respectively.