I am now getting close to the end of my PhD research, and the work is becoming more practical and exciting. The core question has stayed the same: how can artificial intelligence help detect malware in environments where traditional security tooling is too heavy, too slow, or too dependent on cloud-scale resources?
A particularly interesting direction has been looking at ESP32s and Raspberry Pis together. On their own, these devices have very different strengths. ESP32s are low-cost, low-power microcontrollers that can sit close to sensors and simple networked devices. Raspberry Pis provide more compute and flexibility, making them useful as small edge gateways or local analysis nodes. Used together, they create a practical testbed for exploring distributed security monitoring at the edge.
This connects directly with my recent work on multi-modal malware detection. In the paper draft, I explored how visual malware representations can be combined with structural byte and header features, rather than relying on a single stream of evidence. That matters because modern malware can use packing, polymorphism, and other evasion techniques to make one view of a file less reliable. Combining different views gives the model more context.
The next challenge is not just improving model accuracy on datasets such as MalwareVision-2025 and Malimg. It is understanding how these ideas can move toward real, resource-constrained hardware. A Raspberry Pi might handle feature extraction, local coordination, or lightweight inference, while ESP32 devices could help collect signals from the environment or act as part of a distributed sensing layer.
What makes this exciting is that the hardware is accessible. This is AI being tested now, on devices that students, researchers, hobbyists, and small teams can actually afford. As I approach the end of the PhD, that practical bridge between research and real-world edge security is where I want the work to go next.