In the traditional centralized Android malware classification framework, privacy concerns exist due to collected users’ apps containing sensitive information. A new classification framework based on Federated Learning (FL) has emerged to protect privacy. However, significant spatiotemporal heterogeneity exists in the distribution of Android malware samples in different clients. It presents a huge challenge to existing FL schemes, as trained local models differ significantly, resulting in slower model convergence and lower classification accuracy. To bridge this gap, we propose FedDRC, a robust FL-based Android malware classifier. First, we design a functional semantic embedding mechanism of API features, FSEM, using word embedding to improve the robustness of the model to the time heterogeneity of the client’s samples. Secondly, we use the idea of Information Bottleneck (IB) and transfer learning to design a robust local model, PAMIB, to deal with the model degradation caused by the space heterogeneity of the distribution of client samples. Extensive experiments on the Androzoo dataset show that FedDRC has the best robustness for Android malware classification tasks in various heterogeneity distribution settings: fastest convergence and best classification accuracy.

Devising diffusion graph to learn user representations is a crucial step in studying information propagation prediction. However, previous works mainly focused on structural and temporal features. To better incorporate content features, we introduce the Backward Decomposition and Forward Preservation mechanisms. The former involves decomposing content features for initializing node signals in the diffusion graph, thus fusing user features with content features. The latter aims to maintain node features generated by graph encoder consistent with the original content features. A series of experiments demonstrate that our model outperforms state-of-the-art models, and both mechanisms significantly enhance the prediction performance. Furthermore, our methods enables the features generated by the diffusion graph to more effectively incorporate features from various semantic spaces, whether encoded by language models or generated by graph embedding algorithms.

Malware Knowledge Graph (MKG) serves as an essential auxiliary tool for malware detection and analysis. However, the construction of MKG faces several challenges, such as inadequate dataset quality, incomplete entity feature extraction, and the limitations imposed by deep learning techniques. To address these issues, we present an Efficient Framework for constructing a malware knowledge graph (EFwork). Firstly, we build a High-Quality Dataset (HQDataset) and introduce a metric for data quality assessment based on knowledge coverage, timeliness, and density. Subsequently, we develop a Named Entity Recognition (NER) model that extracts character features, part-of-speech features, and word features from the data, leveraging deep learning models to identify malware-related entities. Finally, we implement a rule-based filtering mechanism, utilizing a comprehensive Rule Database to eliminate entities that do not conform to predefined rules. Experimental result shows that our HQDataset demonstrates superior data quality when compared to other open-source datasets. Furthermore, our NER model combined with our Rule Database outperforms existing models, achieving improvements of 0.67%, 0.74%, and 0.69% in Precision, Recall, and F1-Score, respectively.

In the traditional centralized Android malware classification framework, privacy concerns arise as it requires collecting users’ app samples containing sensitive information directly. To address this problem, new classification frameworks based on Federated Learning (FL) have emerged for privacy preservation. However, research shows that these frameworks still face risks of indirect information leakage due to adversary inference. Unfortunately, existing research lacks an effective assessment of the extent and location of this leakage risk. To bridge the gap, we propose the FedDLM, which provides a fine-grained assessment of the risk of sensitive information leakage in an FL-based Android malware classifier. FedDLM estimates attackers’ theoretical maximum inference ability from the information theory perspective to gauge the degree of leakage risk in the classifier effectively. It precisely identifies critical positions in the shared gradient where the leakage risk exists by utilizing characteristics of class activation in classifiers. Through extensive experiments on the Androzoo dataset, FedDLM demonstrates its superior effectiveness and precision compared to baseline methods in evaluating the risk of sensitive information leakage. The evaluation results provide valuable insights into information leakage problems in classifiers and targeted privacy protection methods.

The TLS encryption protocol plays a vital role in securing data transmission, but it also presents challenges for payload-based Network Intrusion Detection Systems (NIDS). Existing methods utilize statistical characteristics of side-channel features, such as the mean packet length, to identify encrypted traffic. However, packet lengths are constrained by the Maximum Segment Size (MSS) of the TCP protocol. This constraint causes the length-varied sequence to be encapsulated into segments of equal length, resulting in information loss. Moreover, flow-level statistical features are vulnerable to interference from noisy packets, making it challenging to detect malicious traffic injected with benign packets effectively. In this paper, we propose an encrypted traffic detection model based on Record length and frEquency Domain Analysis (REDA). First, we reconstruct the TLS Record Length Sequence (TRLS), which is a length-varied sequence, to capture differences in traffic content during transmission. Second, we employ the Discrete Fourier Transform (DFT) to extract frequency domain features of the TRLS, which are resistant to attacker interference. Finally, an improved One-Class Support Vector Machine (OCSVM) algorithm is devised for the unsupervised detection of malicious traffic, enabling the identification of unknown attacks. Experiments show that REDA is superior to other state-of-the-art methods in terms of accuracy by 2.44%.