uitPEclaFL: A Study on PE Malware Classification Using Federated Learning

Malicious software has been posing a considerable threat in cybersecurity. Although, current machine learning approaches have demonstrated their great value in malware detection and classification, the centralization of datasets in training conventional models raises significant privacy concerns, limiting their effectiveness in real-world applications. To address this challenge, we propose a federated learning (FL) framework for classifying Portable Executable (PE) malware. Initially, we train various VGG, ResNet, and MobileNet models on an image-based PE malware dataset, ultimately selecting ResNetl0l with an impressive 92% F1 score for deployment. Subsequently, we integrate this model into our federated learning framework and evaluate its performance under non-IDD and IDD conditions. Notably, our results indicate superior performance in the IDD scenario, achieving F1 scores of 91,52% and 52,79% compared to the non-IDD condition, respectively.