Malware detection using federated learning
AssigneeUab 360 It
InventorsMantas Briliauskas, Dainius Razinskas
Life of this patent
Estimating the term…
Abstract
A malware detection method that uses federated learning includes transmitting file characterization information for one or more local files, receiving a first malware detection model and labeled training data that is generated by a remote device, training the first malware detection model using the labeled training data set, transmitting parameters of the trained first malware detection model to the remote device, and receiving, from the remote device, a second malware detection model, wherein the second malware detection model is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more additional remote devices.
Claims20
A malware detection method that uses federated learning, the method comprising:
- transmitting, to a remote device, file characterization information for one or more local files, wherein the remote device generates a labeled training data set by:
- i) comparing the file characterization information of each of the one or more local files to a malware properties database, and ii) labeling each of the one or more files as either malicious or clean based on the comparison;
- receiving, from the remote device, a first malware detection model and the labeled training data set;
- training the first malware detection model using the labeled training data set;
- transmitting parameters of the trained first malware detection model to the remote device;
- and
- receiving, from the remote device, a second malware detection model, wherein the second malware detection model is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more additional remote devices.
A malware detection system comprising:
- one or more processors;
- and
- memory having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- transmitting, to a remote device, file characterization information for one or more local files, wherein the remote device generates a labeled training data set by:
- i) comparing the file characterization information of each of the one or more local files to a malware properties database, and ii) labeling each of the one or more files as either malicious or clean based on the comparison;
- receiving, from the remote device, a first malware detection model and the labeled training data set;
- training the first malware detection model using the labeled training data set;
- transmitting parameters of the trained first malware detection model to the remote device;
- and
- receiving, from the remote device, a second malware detection model, wherein the second malware detection model is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more additional remote devices.
Dependencies are inferred from the claim text.