Federated Learning Malware Detection Model Training
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems using machine learning models are limited by the exclusion of sensitive files for training, leading to less effective and less accurate detection, and require significant computing resources, which can result in models not tailored to individual user needs.
Innovation Solution
The implementation of federated learning, where a predictive model is distributed to remote devices for training on local files, allowing for the generation of a federated model that combines parameters from multiple devices, reducing computational burden on the service provider and utilizing a broader range of file types without transmitting sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional centralized machine learning training is used, then computing resources can be consolidated on service provider infrastructure, but the model accuracy decreases and cannot be tailored to individual user needs
Solution Approach 1:
The patent divides the centralized training process into distributed segments across multiple client devices. Each client device trains a local copy of the malware detection model using its own files, and then shares only the model parameters (weights) with the service provider. This segmentation allows individualized training on diverse local data while consolidating computational resources at the service provider level for aggregation and model updates.
2Measurement precision
If a broader range of file types are included in training data, then model accuracy improves, but sensitive information may be transmitted to the service provider
Solution Approach 1:
The patent extracts only the essential training information (model parameters) from the full training process and transmits this extracted data to the service provider. The actual sensitive file data remains on the client devices and is never transmitted. This allows the service provider to benefit from training on diverse file types including sensitive documents, images, and executables without compromising data security.
3Adaptability or versatility
If centralized training is used, then data privacy is maintained, but the model cannot be tailored to individual user needs and file structures
Solution Approach 1:
The patent implements local quality by allowing each client device to train the model using its own specific files, documents, and data structures. This enables the model to adapt to individual user needs and local file characteristics. After local training, only the optimized parameters are shared with the service provider, maintaining data privacy while achieving personalization.
4Loss of information
If limited file types are used for training, then sensitive information is protected, but model effectiveness decreases
Solution Approach 1:
The patent enables self-service by allowing client devices to autonomously train the malware detection model using their own local files without requiring service provider intervention or data transmission. Each device independently processes its own data, maintaining privacy while improving detection effectiveness through diverse local training data including documents, images, and executables.
Data Source
AI summary
A malware detection method that uses federated learning includes transmitting file characterization information for one or more local files, receiving a first malware detection model and labeled training data that is generated by a remote device, training the first malware detection model using the labeled training data set, transmitting parameters of the trained first malware detection model to the remote device, and receiving, from the remote device, a second malware detection model, wherein the second malware detection model is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more additional remote devices.