Work

A method for real-world privacy-preserving Android malware detection through Federated Machine Learning

Year: 2025

Type: article

Abstract: One of the most critical issues associated with the use of the Internet of Things and Internet of Everything devices is privacy. Over the years, several methods have been introduced to try to address this phenomenon. In 2016, Google introduced the concept of Federated Learning, an innovative machine learning paradigm that allows models to be trained collaboratively across multiple decentralized devices or servers, holding local data samples, without exchanging them. This approach enhances data privacy and security by ensuring that raw data remains on local devices while only model updates are shared and aggregated. In this paper, we present a privacy-preserving Android malware detector based on Federated Machine Learning. As a first step, we built a dataset comprising over 40,000 Android applications, including trusted and malicious (belonging to 72 malware families) samples. Afterward, we conducted experiments on two pre-trained models by exploiting the CIFAR-10 and the ImageNet datasets, employing hyperparameters determined through a Grid Search algorithm by exploiting 40 different clients. Moreover, the experimental analysis exploits two different distributions: Default Distribution and Dirichlet Distribution. Across these two distributions, we also proposed two different experiments for each distribution and pre-trained model: one without using any norm, and another where we employed the Clipping Norm aggregator. The results indicate that the model exhibits interesting performances with a Default distribution, achieving an accuracy of 0.816 without normalization and 0.805 with the Clipping Norm aggregator. However, with a Dirichlet Distribution, the model accuracy is equal to 0.773 without normalization and equal to 0.744 with the Clipping Norm aggregator. Both experiments show that the proposed method can provide interesting performances in privacy-preserving Android malware detection.

Source: Information and Software Technology

DOI: 10.1016/j.infsof.2025.107892

Authors: Giovanni Ciaramella, Fabio Martinelli, Christian Peluso, Antonella Santone, Francesco Mercaldo

Institutions: IMT School for Advanced Studies Lucca, Institute of Informatics and Telematics, National Research Council, Institute for High Performance Computing and Networking, University of Molise

Language: English

Topic: Advanced Malware Detection Techniques

Subfield: Signal Processing

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $3,830

Funders: Istituto Nazionale per l'Assicurazione Contro Gli Infortuni sul Lavoro, Ministero dell'Università e della Ricerca