A distributed framework for zero-day malware detection using federated ensemble models.

Area of Science:

• Cybersecurity
• Machine Learning
• Malware Analysis

Background:

• Zero-day attacks pose significant cybersecurity challenges due to malware variety and imbalanced datasets.
• Real-time detection and classification of these attacks are complex and often inaccurate.
• There is a critical need for intelligent, adaptive defense mechanisms with improved precision and robustness.

Purpose of the Study:

• To propose a stacked ensemble federated learning model for accurate zero-day attack classification.
• To address inter- and intra-class similarities among malware families using an accuracy-aware node weighting scheme.
• To enhance generalization and robustness in malware detection.

Main Methods:

• Malware Portable Executable (PE) files were collected, validated, and converted into image format for 28 family categorizations.
• Deep features were extracted using a transfer learning-based fine-tuned ResNet-50 model.
• A novel Ensemble Stacked Federated Model integrated features from distributed nodes for classification.

Main Results:

• The proposed model demonstrated superior accuracy and computational efficiency compared to baseline approaches.
• Independent training at federated nodes and central stacking improved learning rates and reduced overfitting.
• The model achieved robust classification performance on private and public datasets.

Conclusions:

• The stacked ensemble federated learning model offers a promising solution for zero-day attack detection.
• The accuracy-aware node weighting scheme effectively handles malware classification challenges.
• The approach provides enhanced generalization and robustness, outperforming existing methods.