MobiShield: Federated Android Malware Detection with Adaptive Differential Privacy under Concept Drift
Abstract
Abstract Android has become the dominant target for malware authors, and the threat is no longer static - attackers continuously repackage and obfuscate malicious code to evade detection. Federated learning offers a compelling path forward by letting mobile devices collaborate on a shared detection model without ever surrendering their raw application data. In practice, however, three problems consistently undermine this promise: devices contribute data that follow very different distributions (non-IID heterogeneity), the malware landscapes drift over time so that a model trained today degrades tomorrow, and the gradient updates devices send to the server can inadvertently leak sensitive behavioural information. Existing federated frameworks tackle at most one or two of these issues in isolation; none addresses all three together. We built MobiShield around the observation that drift and privacy are not independent concerns – when the malware distribution shifts, the appropriate level of noise to inject changes too. The framework brings together four tightly coupled modules. AHFS uses a per-client multi-head attention mask to re-weight the hybrid static-dynamic feature vector before local training, reducing the damage caused by heterogeneous data. DFDD runs a Hoeffding-based drift detector on each client and aggregates the local signals at the server through a KL-divergence-weighted EWMA, producing a single global drift score ˆZ(t) every round. That score feeds directly into…
Read the paper
Related studies
- Active Learning during Federated Learning for Object Detection
- Fairness-aware federated learning
- Decentralized Federated Learning
- Building a Personally Identifiable Information Recognizer in a Privacy Preserved Manner Using Automated Annotation and Federated Learning
- Preservation of Patient Level Privacy: Federated Classification and Calibration Models
- Efficient explainable federated learning
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.