Android Malware Detection Based on Network Analysis and Federated Learning

With the dramatic growth of available Android applications in today’s digital era, Android malware has grown accordingly in both quantity and sophistication, becoming a serious threat to network security and user privacy. In addition, with a large-scale Android system deployment and the raising of privacy concerns, data heterogeneity, availability, and privacy preservation are presenting major challenges when applying traditional cloud-based and machine learning-based security solutions. This chapter proposes a novel, cost-effective, deep learning-based malware detection model using the emergent federated learning paradigm (FDL). The aim is to incorporate many devices with corresponding resources (i.e., computation and data) to collaboratively train a global security model using transfer learning instead of sharing their data, to detect large-scale malware attacks efficiently and more effectively while maintaining data privacy. Specifically, we trained a convolutional neural network model using FL-based decentralized optimization for detecting Android malware based on network behavior. Then, we evaluated the proposed training methodology with the benchmark dataset AAGM-2017 under different FL settings and compared it with centralized training. Experimental results proved the efficiency and effectiveness of the proposed FDL methodology in terms of accuracy, precision, detection rate, and computation cost while ensuring data privacy.