HDDroid: Federated Hyperdimensional Computing for Mobile Malware Detection

Abstract

Mobile malware poses significant security and privacy risks, hence effective detection methods are crucial. Graph-based representations of mobile applications have been shown to be well-suited for this task. However, traditional graph-based machine learning techniques are computationally expensive and unsuitable for on-device analysis. Nevertheless, off-device analysis raises privacy concerns, making on-device analysis combined with decentralized learning approaches like Federated Learning (FL) an attractive alternative. Hyperdimensional Computing (HDC) offers efficient graph classification on resource-constrained mobile devices. This work introduces HDDroid, an FL framework leveraging HDC to detect malicious software via function call graph analysis. HDDroid’s novel online encoding strategy reduces memory usage, enabling large graph analysis on mobile devices. Additionally, HDDroid’s improved model aggregation strategy enhances model robustness and classification accuracy, achieving state-of-the-art performance in distributed learning scenarios.