Towards Deep Federated Defenses Against Malware in Cloud Ecosystems

Payne, Josh; Kundu, Ashish

doi:10.1109/tps-isa48467.2019.00020

Cited by 11 publications

(4 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Federated learning for cyber security. Federated learning has been proposed for enhancing cyber security in various settings including mobile phones [24], Internet-Of-Things [47], [61], cloud ecosystems [52]. Closer to our work, Khramtsova et al [33] study federated learning approaches on malicious URL detection to show the benefit of sharing information about local detections.…”

Section: Related Workmentioning

confidence: 85%

CELEST: Federated Learning for Globally Coordinated Threat Detection

Ongun¹,

Boboila²,

Oprea³

et al. 2022

Preprint

View full text Add to dashboard Cite

The cyber-threat landscape has evolved tremendously in recent years, with new threat variants emerging daily, and large-scale coordinated campaigns becoming more prevalent. In this study, we propose CELEST (CollaborativE LEarning for Scalable Threat detection), a federated machine learning framework for global threat detection over HTTP, which is one of the most commonly used protocols for malware dissemination and communication. CELEST leverages federated learning in order to collaboratively train a global model across multiple clients who keep their data locally, thus providing increased privacy and confidentiality assurances. Through a novel active learning component integrated with the federated learning technique, our system continuously discovers and learns the behavior of new, evolving, and globally-coordinated cyber threats. We show that CELEST is able to expose attacks that are largely invisible to individual organizations. For instance, in one challenging attack scenario with data exfiltration malware, the global model achieves a three-fold increase in Precision-Recall AUC compared to the local model. We deploy CELEST on two university networks and show that it is able to detect the malicious HTTP communication with high precision and low false positive rates. Furthermore, during its deployment, CELEST detected a set of previously unknown 42 malicious URLs and 20 malicious domains in one day, which were confirmed to be malicious by VirusTotal.

show abstract

Section: Related Workmentioning

confidence: 85%

CELEST: Federated Learning for Globally Coordinated Threat Detection

Ongun¹,

Boboila²,

Oprea³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…To guarantee the privacy of data used for ML training, a federated learning mechanism has recently been proposed. This concept of distributed ML was used in a multicloud environment, where multiple clouds worked together against the spread of malware without exposing sensitive information [183]. A federated learning system for Android malware detection was proposed in [184], where mobile devices worked together to learn the master classifier based on local learning on each mobile device.…”

Section: F Machine Learning In Response To Security Challengesmentioning

confidence: 99%

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

Caviglione

Choraś

Corona³

et al. 2021

IEEE Access

100

View full text Add to dashboard Cite

“…The performance evaluation on three IoT datasets (the Contagio dataset, Drebin dataset, and Genome dataset) using different features show that the Fed-IIoT system performs significantly better than other local adversarial training mechanisms. To perform malware detection in cloud computing environments, Payne and Kundu [91] proposed a hierarchical approach towards deep federated defences. Their proposed approach formalized malware detection as a graph and hypergraph learning problem.…”

Section: B Federated Learning-based Malware Detectionmentioning

confidence: 99%

Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis

Ferrag¹,

et al. 2021

View full text Add to dashboard Cite

In this article, we present a comprehensive study with an experimental analysis of federated deep learning approaches for cyber security in the Internet of Things (IoT) applications. Specifically, we first provide a review of the federated learning-based security and privacy systems for several types of IoT applications, including, Industrial IoT, Edge Computing, Internet of Drones, Internet of Healthcare Things, Internet of Vehicles, etc. Second, the use of federated learning with blockchain and malware/intrusion detection systems for IoT applications is discussed. Then, we review the vulnerabilities in federated learning-based security and privacy systems. Finally, we provide an experimental analysis of federated deep learning with three deep learning approaches, namely, Recurrent Neural Network (RNN), Convolutional Neural Network (CNN), and Deep Neural Network (DNN). For each deep learning model, we study the performance of centralized and federated learning under three new real IoT traffic datasets, namely, the Bot-IoT dataset, the MQTTset dataset, and the TON_IoT dataset. The goal of this article is to provide important information on federated deep learning approaches with emerging technologies for cyber security. In addition, it demonstrates that federated deep learning approaches outperform the classic/centralized versions of machine learning (non-federated learning) in assuring the privacy of IoT device data and provide the higher accuracy in detecting attacks.

show abstract

Towards Deep Federated Defenses Against Malware in Cloud Ecosystems

Cited by 11 publications

References 43 publications

CELEST: Federated Learning for Globally Coordinated Threat Detection

CELEST: Federated Learning for Globally Coordinated Threat Detection

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis

Contact Info

Product

Resources

About