On-device Malware Detection using Performance-Aware and Robust Collaborative Learning

A Novel Malware Detection Mechanism based on Features Extracted from Converted Malware Binary Images

“…The obtained HPCs are fed to multi-stage machine learning (ML) classifier for detecting and classifying the malware. Authors in [45] presents a collaborative machine learning (ML)-based malware detection framework. It introduces a) performance-aware precision-scaled federated learning (FL) to minimize the communication overheads with minimal device-level computations; and (2) a Robust and Active Protection with Intelligent Defense strategy against malicious activity (RAPID) at the device and network-level due to malware and other cyber-attacks.…”

FedHGCDroid: An Adaptive Multi-Dimensional Federated Learning for Privacy-Preserving Android Malware Classification

“…Privacy issues during training are not considered. [9] Presented a novel classification approach based on dynamic analysis, which is robust to the obfuscation [11] Propose a novel and efficient approach which uses LSTM to obtain the feature representations of opcode sequences of malware [19] Feature mining of function call graph is carried out by graph embedding technique [15] Propose an approach that transforms the control flow diagram into RGB images for the convolutional neural network for malware detection [14] Propose a highly efficient method to extract API calls, permission rate, surveillance system events, and permissions as features [21] Proposed a semi-supervised federated learning algorithm that works without user supervision These schemes' lack of adaptability to the problems that the non-IID distribution of malware on different clients [22] Introduces a performance-aware FL framework to reduce the communication overhead of device-level computing [23] Proposed a robust FL-based framework, namely, Fed-IIoT, for detecting Android malware in the Internet of Things Existing methods that use ML/DL to classify malware rely on the vast amount of high-quality available data from different clients to train the accurate global model. These models are then distributed to individual clients, or these clients upload their test data to the server for real-time behavior checking and malware classification.…”

“…In addition, the author designed an auxiliary classifier generative adversarial network (AC-GAN) to generate invisible data for training. Shukla [ 22 ] introduces a performance-aware FL framework to reduce the communication overhead of device-level computing. Singh [ 25 ] uses the FL framework to train a web security model from users’ browsing data and share it with a centralized server.…”

“…However, in multi-type classification, multi-dimensional mining of malicious behavior has greater advantages. In this section, we compare the performance of our proposed FedHGCDroid scheme with some state-of-the-art studies on FL-based malware classification schemes including Fed-IIoT (Taheri et al 2021) [23], RAPID (Shukla et al 2021) [22], LiM (Galvez et al 2021) [21] with an identical simulation configuration. We fully reproduce these malware classification schemes in our work and compare the performance (classification performance and adaptive performance) with the proposed FedHGCDroid.…”

“…The experimental results are shown in Tables 11-13, with each column representing different data partitioning methods and each row representing different FL-based malware classification schemes. Fed-IIoT [23], RAPID [22], LiM [21]…”