Resource-Aware Federated Learning for Malware Detection on Smart Devices

Abstract

The proliferation of sophisticated malware capable of attacking personal devices or permeating the environments in which users live requires autonomous detection systems that are both effective and privacy-preserving. Graph Neural Networks are promising in capturing complex application behaviors and may be suitable for detecting malicious software. However, their adoption and deployment in smart computing environments is hindered by the hardware heterogeneity of edge devices and the sensitive nature of user data. This paper introduces a resource-aware Federated Learning framework for malware detection that leverages Heterogeneous Graph Transformers (HGTs). To address the diverse hardware capabilities found in mobile ecosystems, this work proposes an adaptive training strategy: while high-performance clients utilize more computationally intensive analysis methods for comprehensive feature extraction, resource-constrained nodes participate in the global model aggregation using only lightweight feature subsets. Furthermore, the intrinsic mechanistic interpretability of HGTs is exploited by analyzing attention maps to identify the specific features that the model pays most attention to during classification, relating them to known attack techniques. The experimental evaluation shows that this approach maintains high detection accuracy across a heterogeneous client base while providing useful insights into malware behavior and preserving user privacy through local-only data processing.