Privacy-Preserving Federated Malware Detection Using Memory and Behavioral Features

The rapid growth of sophisticated malware and the increasing diversity of computing environments have exposed critical limitations in traditional centralized malware detection systems, particularly in data privacy, scalability, and adaptability. This study proposes a privacy-preserving, collaborative malware-detection framework that leverages federated learning to improve detection accuracy while keeping sensitive data local to participating devices. The objective is to address emerging malware threats by combining behavioral and memory-based analysis within a decentralized learning paradigm. The proposed framework employs federated learning to train a global malware detection model without transferring raw data. Each client locally extracts discriminative features derived from system behavior and memory artifacts, including process activity patterns, memory access characteristics, and runtime indicators. Local deep learning models are trained independently, and only model parameters are shared with a central aggregator, which constructs an optimized global model through iterative parameter aggregation. This approach significantly reduces privacy risks and communication overhead compared to centralized training. Experimental evaluations on benchmark malware datasets demonstrate that the proposed federated approach achieves detection performance comparable to, and in some cases exceeding, that of centralized deep learning models. The results indicate improved robustness against previously unseen malware variants, with high detection accuracy and reduced false positive rates. Furthermore, privacy is preserved throughout the learning process, making the framework suitable for real-world distributed, resource-constrained environments. The findings confirm that federated learning, combined with memory and behavioral feature analysis, provides an effective, privacy-aware solution for modern malware detection. This work contributes to recent advances in cybersecurity by offering a scalable, secure, and practical detection framework that can be deployed across distributed systems, including enterprise networks and edge computing environments.