FL-MalDrift: a federated learning framework for malware detection under local concept drift

Area of Science:

• Cybersecurity
• Machine Learning
• Mobile Security

Background:

• Continuous evolution of Android malware causes concept drift, degrading detector accuracy.
• Federated learning (FL) faces challenges with non-IID and shifting client data, destabilizing aggregation and impacting privacy.

Purpose of the Study:

• To propose FL-MalDrift, a novel federated framework resilient to concept drift for Android malware detection.
• To enhance the accuracy and stability of FL-based malware detectors in dynamic environments.

Main Methods:

• Integration of lightweight on-device drift detection algorithms (ADWIN, DDM, EDDM, HDDM) with adaptive participation control.
• Server-side regulation using EWMA-smoothed drift scores to selectively aggregate stable client updates (FedAvg, FedSGD).
• Client-side drift mitigation before update contribution.

Main Results:

• Achieved high accuracy: 94.7% on Drebin, 96.8% on CICMalDroid 2020, and 92.4% on AndroZoo.
• Demonstrated framework stability under client heterogeneity and concept drift.
• Maintained privacy preservation while filtering drift-affected updates.

Conclusions:

• FL-MalDrift offers a scalable, privacy-preserving solution for robust Android malware detection in non-stationary environments.
• Coupling client-side drift detection with dynamic participation control effectively stabilizes FL training.
• Future work includes differential privacy, compression-aware aggregation, and large-scale validation.