Privacy-Preserving Malware Detection with Explainable AI (XAI) - A Federated Learning Approach

Sammanfattning

The privacy risk of the conventional centralized Artificial Intelligence(AI) model and the un interpretability of established security solutionsare two major concerns in the field of malware detection in contemporary cybersecurity that are addressed in this thesis. For the resolutionof these problems, a privacy-preserving malware detection frameworkis prepared utilizing Federated Learning (FL) and Explainable Artificial Intelligence (XAI). FL and XAI are used to develop a malwaredetection system that protects privacy. Fundamentally, FL allows amodel to be trained across several client devices without requiring anyraw or potentially sensitive data to ever leave SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations(LIME), are used to give the model decisions some interpretability,granting cybersecurity analysts vital understanding on why certainfiles were considered malicious. The framework was realized andevaluated through a quantitative experimental approach, whereby aLogistic Regression model was trained in a federated setting using network traffic data. The performance of the model is then evaluated byusing typical performance metrics such as accuracy, precision, recall,and F1-score. In the evaluation, excellent classification accuracy (99.78)for the test data was demonstrated. The study also explored integrating Differential Privacy (DP) into the algorithm to minimize its impacton accuracy in this implementation. Interpretability with SHAP andLIME was successfully demonstrated. In addition, a real-time FlaskApplication Programming Interface (API) was used.