FedDroidADP: An Adaptive Privacy-Preserving Framework for Federated-Learning-Based Android Malware Classification System

Federated-Learning-based Android malware classification framework has attracted much attention due to its privacy-preserving and multi-party joint modeling. However, research shows indirect privacy inferences from curious central servers threaten this framework. Adding noise to the model parameters to limit the adversary’s inference to sensitive knowledge is widely used to prevent this threat. Still, it dramatically reduces the classification performance of the model. In response to this challenge, we propose a privacy-preserving framework FedDroidADP, which can adapt to the law of privacy risk distribution to protect the privacy of FL-based Android malware classifier users while maintaining model utility. First, we estimate the privacy risk of Android users in the classification system by calculating the mutual information between the sharing gradient and the user’s sensitive information (Such as the category of the user’s app and malware). Then, we designed an adaptive differential privacy protection mechanism ADP according to the distribution law of the privacy risk in time and space dimensions. The mechanism calculates the added lightweight noise required to protect the user’s sensitive information (to a certain extent) in a fine-grained manner to trade off model privacy and utility during the training of Android malware classification models. Extensive experiments on the Androzoo dataset show that FedDroidADP’s ability to protect user’s sensitive information is superior to the baseline differential privacy methods and achieves better model utility (about 8% higher classification accuracy) in the same privacy budget.