Privacy-Preserving Malware Detection with Explainable AI (XAI) - A Federated Learning Approach
2025 (English)Independent thesis Advanced level (degree of Master (One Year)), 10 credits / 15 HE credits
Student thesis
Abstract [en]
The privacy risk of the conventional centralized Artificial Intelligence(AI) model and the un interpretability of established security solutionsare two major concerns in the field of malware detection in contemporary cybersecurity that are addressed in this thesis. For the resolutionof these problems, a privacy-preserving malware detection frameworkis prepared utilizing Federated Learning (FL) and Explainable Artificial Intelligence (XAI). FL and XAI are used to develop a malwaredetection system that protects privacy. Fundamentally, FL allows amodel to be trained across several client devices without requiring anyraw or potentially sensitive data to ever leave SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations(LIME), are used to give the model decisions some interpretability,granting cybersecurity analysts vital understanding on why certainfiles were considered malicious. The framework was realized andevaluated through a quantitative experimental approach, whereby aLogistic Regression model was trained in a federated setting using network traffic data. The performance of the model is then evaluated byusing typical performance metrics such as accuracy, precision, recall,and F1-score. In the evaluation, excellent classification accuracy (99.78)for the test data was demonstrated. The study also explored integrating Differential Privacy (DP) into the algorithm to minimize its impacton accuracy in this implementation. Interpretability with SHAP andLIME was successfully demonstrated. In addition, a real-time FlaskApplication Programming Interface (API) was used.
Place, publisher, year, edition, pages
2025.
Keywords [en]
Malware Detection, Privacy Preservation, Federated Learn- ing (FL), Explainable AI (XAI), SHAP, LIME, Cybersecurity, AI-driven Security, Data Confidentiality, Interpretability
National Category
Computer Systems
Identifiers
URN: urn:nbn:se:hh:diva-56367OAI: oai:DiVA.org:hh-56367DiVA, id: diva2:1968453
Presentation
2025-05-27, 10:30 (English)
Supervisors
Examiners
2025-06-132025-06-122025-10-01Bibliographically approved