Privacy-Preserving Android Malware Detection Based on Federated Learning

Abstract

In response to the explosive growth of Android smartphones and the corresponding surge in mobile malware, traditional security solutions which rely on aggregating raw user data in a central repository pose unacceptable privacy risks. Although classical Machine Learn- ing and Deep Learning classifiers achieve high detection rates, they typically demand unrestricted access to sensitive behavioral or system logs. To address this dilemma, we propose a privacy-preserving Android malware detection framework based on Federated Learning. In our approach, each user device independently trains a Convolutional Neural Network (CNN) on its local data and transmits only model updates to a coordinating server. The server integrates these updates (using FedAvg or FedProx) into a global model and redistributes it for successive local training rounds. We evaluate performance on the CICAndMal2020 dataset under both IID and non-IID data partitions, experiment- ing with 3, 5, and 10 client configurations. Our results demonstrate that the federated models not only rival but in some settings surpass the accuracy of a centrally trained coun- terpart while ensuring that all raw data remain on end-user devices. This work highlights Federated Learning’s promise for scalable, privacy-aware Android malware defense.