Vertical Federated Learning in Malware Detection for Smart Cities
Dimitrios N. Serpanos, Georgios Xenos · 2023
Malware detection is fundamental to smart city cyberphysical systems, considering their requirements for safety which is dependent on their security. Malware detection systems extract features from software samples through static and/or dynamic analysis and classify them as malware or benign, based on the features. Modern malware detection systems employ Deep Neural Networks (DNNs) whose accuracy increases as more data are analyzed and exploited. However, data sharing among organizations, even for malware, is limited due to privacy and intellectual property constraints. In this paper we investigate the effectiveness of vertical federated learning (VFL) for developing aggregated DNNs among autonomous interconnected organizations. We analyze a solution where multiple organizations use independent malware analysis platforms as part of their Security Operations Centers (SOCs) and train their own local DNN model on their own private data. Employing a DNN, we investigate VFL scalability in terms of the number of participants, considering accuracy and training execution time as the determining factors. We evaluate the approach using the EMBER benchmark dataset and demonstrate that the accuracy of a centralized model is achieved by VLF as well, independently of the number of clients, while training execution time scales linearly for the evaluated federation sizes and remains within acceptable bounds for adoption in practice. Furthermore, we evaluate the achieved accuracy per client (federation member) demonstrating that individual accuracy is significantly smaller per client. The significant improvement in accuracy that clients achieve by participating in the federation provides strong motivation for clients to participate in the federation, while FL provides them with the necessary privacy that is achieved by sharing features rather than samples.