DeepShield: Privacy-Preserving Malware Classification using Split Learning

Malware detection is difficult to accomplish within distributed environments like the Internet of Things (IoT) and enterprise networks for two key reasons: protecting user privacy and adapting to new variants of malicious software. Traditional centralized deep learning methods achieve the highest accuracy but leak sensitive data to an unauthorized party, and existing federated or split learning methods leak sensitive data and either have communication bottlenecks, or lack the development of a robust deep learning solution due to low power processing devices and non-identically independently distributed (non-IID) data. This study introduces DeepShield, a new framework for privacy-preserving malware classification that implements a split learning approach, adaptive sanitization of features, homomorphic encryption, and meta-learning. The proposed approach protects privacy by splitting deep neural networks (DNNs) between individual client devices and the central server to share encrypted intermediate activations instead of raw data. The framework uses a meta-learning module to reduce retraining effort when new malware families are discovered. The experimentation on benchmark malware datasets demonstrates that DeepShield achieves $96.1 \%$ classification accuracy with a mutual information leakage of natural logarithm($\mathbf{0. 0 9}$). DeepShield outperformed all baseline and. current split learning and federated models while improving a lower communication overhead. This evidence indicates DeepShield balances user privacy with accuracy and scalability for real-world heterogeneous computing environments.