Packed and Unpacked Malware Detection by Means of Explainable Federated Machine Learning

Abstract

: The number of cybersecurity attacks has drastically increased in the last few decades. Although researchers and experts have proposed several methods to curb them, malicious actors continue to develop new techniques to perpetrate attacks. Among these techniques, attackers often use software known as a packer to obfuscate or compress executable code. Thus, it allows us to obtain a different file representation, making the analysis process more difficult. Given the widespread use of malware in companies and the need to avoid sharing sensitive data, this research article proposes a malware detection method based on Federated Machine Learning. In detail, we trained several models leveraging a publicly available dataset of Portable Executable and Object Linking and Embedding files from the Windows environment, which we converted into images using a Python script. To enhance the privacy and security of the model, we employed the zeroing norm aggregator, which zeroes to mitigate the risk of gradient leakage attacks. Moreover, we employed non-Independent and Iden-tically Distributed data to represent a real-world scenario better. Once we concluded the training phase, we also evaluated the best model on original samples and on samples processed with three state-of-the-art packers (MPRESS, BEP, and GZexe) to assess its robustness. Specifically, the baseline accuracy of 0.881 increased slightly with MPRESS (+0.003) and GZexe (+0.004). However, the BEP-packed samples showed the greatest improvement, achieving an accuracy of 0.972. Finally, we applied the Gradient-weighted Class Activation Mapping++ algorithm to highlight the image regions that influenced the classification results.