hh.sePublications
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Privacy-Preserving Malware Detection with Explainable AI (XAI) - A Federated Learning Approach
Halmstad University, School of Information Technology.
Halmstad University, School of Information Technology.
2025 (English)Independent thesis Advanced level (degree of Master (One Year)), 10 credits / 15 HE creditsStudent thesis
Abstract [en]

The privacy risk of the conventional centralized Artificial Intelligence(AI) model and the un interpretability of established security solutionsare two major concerns in the field of malware detection in contemporary cybersecurity that are addressed in this thesis. For the resolutionof these problems, a privacy-preserving malware detection frameworkis prepared utilizing Federated Learning (FL) and Explainable Artificial Intelligence (XAI). FL and XAI are used to develop a malwaredetection system that protects privacy. Fundamentally, FL allows amodel to be trained across several client devices without requiring anyraw or potentially sensitive data to ever leave SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations(LIME), are used to give the model decisions some interpretability,granting cybersecurity analysts vital understanding on why certainfiles were considered malicious. The framework was realized andevaluated through a quantitative experimental approach, whereby aLogistic Regression model was trained in a federated setting using network traffic data. The performance of the model is then evaluated byusing typical performance metrics such as accuracy, precision, recall,and F1-score. In the evaluation, excellent classification accuracy (99.78)for the test data was demonstrated. The study also explored integrating Differential Privacy (DP) into the algorithm to minimize its impacton accuracy in this implementation. Interpretability with SHAP andLIME was successfully demonstrated. In addition, a real-time FlaskApplication Programming Interface (API) was used.

Place, publisher, year, edition, pages
2025.
Keywords [en]
Malware Detection, Privacy Preservation, Federated Learn- ing (FL), Explainable AI (XAI), SHAP, LIME, Cybersecurity, AI-driven Security, Data Confidentiality, Interpretability
National Category
Computer Systems
Identifiers
URN: urn:nbn:se:hh:diva-56367OAI: oai:DiVA.org:hh-56367DiVA, id: diva2:1968453
Presentation
2025-05-27, 10:30 (English)
Supervisors
Examiners
Available from: 2025-06-13 Created: 2025-06-12 Last updated: 2025-10-01Bibliographically approved

Open Access in DiVA

fulltext(2378 kB)398 downloads
File information
File name FULLTEXT02.pdfFile size 2378 kBChecksum SHA-512
f71ff46d798a47028b1a9e3221dc7686300de2584dbdb1a4a8667d8582fcd5ed7a102e836306688adbd61711ef3958b4c97350da04b775be6911e3355f709359
Type fulltextMimetype application/pdf

By organisation
School of Information Technology
Computer Systems

Search outside of DiVA

GoogleGoogle Scholar
Total: 398 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

urn-nbn

Altmetric score

urn-nbn
Total: 422 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf