Elena Ferrari

Crypto-ransomware has caused an unprecedented scope of impact in recent years, with an evolving level of sophistication. An extensive range of studies have been conducted on defending against ransomware and reviewing the efficacy of various protections. However, for practical defenses, deployability holds equal significance as detection accuracy. Therefore, in this study, we review 117 published ransomware defense works, categorize them by the level they are implemented, and discuss the deployability. API-based solutions are easy to deploy, and most existing works focus on machine learning-based classification. To provide more insights, we quantitatively characterize the runtime behaviors of real-world ransomware samples. Based on our experimental findings, we present a possible future detection direction with our consistency analysis and API-contrast-based refinement. Moreover, we experimentally evaluate various commercial defenses and identify the security gaps. Our findings help the field understand the deployability of ransomware defenses and create more effective, practical solutions.

The proliferation of edge devices has created an urgent need for security solutions capable of detecting malware in real time while operating under strict computational and memory constraints. Recently, Large Language Models (LLMs) have demonstrated remarkable capabilities in recognizing complex patterns, yet their deployment on edge devices remains impractical due to their resource demands. However, in edge malware detection, static or centrally retrained models degrade under evolving threats and heterogeneous traffic; locally trained models become siloed and fail to transfer across domains. To overcome these limitations, in this paper, we present a continuous learning architecture for edge-based malware detection that combines local adaptation on each device with global knowledge sharing through parameter-efficient LoRA adapters. Lightweight transformer models (DistilBERT, DistilGPT-2, TinyT5) run on edge nodes and are incrementally fine-tuned on device-specific traffic; only the resulting LoRA modules are aggregated by a lightweight coordinator and redistributed, enabling cross-device generalization without exchanging raw data. We evaluate on two public IoT security datasets, Edge-IIoTset and TON-IoT, under multi-round learning to simulate evolving threats. Compared to isolated fine-tuning, the LoRA-based exchange yields up to 20-25% accuracy gains when models encounter previously unseen attacks from another domain, while maintaining stable loss and F1 across rounds. LoRA adds less than 1% to model size (~0.6-1.8 MB), making updates practical for constrained edge hardware.

The rapid evolution of malware attacks calls for the development of innovative detection methods, especially in resource-constrained edge computing. Traditional detection techniques struggle to keep up with modern malware’s sophistication and adaptability, prompting a shift towards advanced methodologies like those leveraging Large Language Models (LLMs) for enhanced malware detection. However, deploying LLMs for malware detection directly at edge devices raises several challenges, including ensuring accuracy in constrained environments and addressing edge devices’ energy and computational limits. To tackle these challenges, this article proposes an architecture leveraging lightweight LLMs’ strengths while addressing limitations like reduced accuracy and insufficient computational power. To evaluate the effectiveness of the proposed lightweight LLM-based approach for edge computing, we perform an extensive experimental evaluation using several state-of-the-art lightweight LLMs. We test them with several publicly available datasets specifically designed for edge and IoT scenarios, and different edge nodes with varying computational power and characteristics.

Unmanned aerial vehicles (UAVs) areincreasingly integral to various applications, generating vast data like high-resolution imagery and environmental metrics, yet they face challenges in real-time regulatory compliance. As a vision paper, UAVSync-BD proposes a conceptual synchronization process, with implementation details, testbeds, and datasets deferred to future research for reproducibility. This position paper conducts a meta-analysis of UAV technology, compares regional regulations, and proposes a reference architecture for a Big Data framework leveraging distributed processing, edge computing, and AI-driven analytics to ensure UAV regulatory compliance. It also discusses open research challenges in the field.

This paper introduces AeroTrust-5D, an innovative trust management system for Unmanned Aerial Vehicles (UAVs) designed to enhance the security of autonomous Air-to-Air (A2A) flights. AeroTrust-5D assesses trust across five critical dimensions: safety, security, mission, environment, and airspace, incorporated into each UAV's profile. It leverages local and global trust assessments to enhance UAV collaboration in dynamic environments. Local trust values enable real-time responsiveness, while global trust values, computed and managed by Control Stations, provide a comprehensive perspective on UAV reliability. We conducted a detailed simulation to evaluate AeroTrust-5D trust model under various operational scenarios. The outcomes showcase the AeroTrust-5D's robustness in trust assessment, effectively adjusting trust scores in response to simulated attacks and environmental challenges.