{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,11]],"date-time":"2026-05-11T14:27:44Z","timestamp":1778509664311,"version":"3.51.4"},"reference-count":41,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2022,7,1]],"date-time":"2022-07-01T00:00:00Z","timestamp":1656633600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Natural Science Foundation of China","award":["61902013"],"award-info":[{"award-number":["61902013"]}]},{"name":"National Natural Science Foundation of China","award":["U1636208"],"award-info":[{"award-number":["U1636208"]}]},{"name":"National Natural Science Foundation of China","award":["61862008"],"award-info":[{"award-number":["61862008"]}]},{"name":"National Natural Science Foundation of China","award":["YWF-20-BJ-J-1038"],"award-info":[{"award-number":["YWF-20-BJ-J-1038"]}]},{"name":"National Natural Science Foundation of China","award":["YWF-21-BJ-J-1039"],"award-info":[{"award-number":["YWF-21-BJ-J-1039"]}]},{"name":"Beihang Youth Top Talent Support Program","award":["61902013"],"award-info":[{"award-number":["61902013"]}]},{"name":"Beihang Youth Top Talent Support Program","award":["U1636208"],"award-info":[{"award-number":["U1636208"]}]},{"name":"Beihang Youth Top Talent Support Program","award":["61862008"],"award-info":[{"award-number":["61862008"]}]},{"name":"Beihang Youth Top Talent Support Program","award":["YWF-20-BJ-J-1038"],"award-info":[{"award-number":["YWF-20-BJ-J-1038"]}]},{"name":"Beihang Youth Top Talent Support Program","award":["YWF-21-BJ-J-1039"],"award-info":[{"award-number":["YWF-21-BJ-J-1039"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>With the popularity of Android and its open source, the Android platform has become an attractive target for hackers, and the detection and classification of malware has become a research hotspot. Existing malware classification methods rely on complex manual operation or large-volume high-quality training data. However, malware data collected by security providers contains user privacy information, such as user identity and behavior habit information. The increasing concern for user privacy poses a challenge to the current malware classification scheme. Based on this problem, we propose a new android malware classification scheme based on Federated learning, named FedHGCDroid, which classifies malware on Android clients in a privacy-protected manner. Firstly, we use a convolutional neural network and graph neural network to design a novel multi-dimensional malware classification model HGCDroid, which can effectively extract malicious behavior features to classify the malware accurately. Secondly, we introduce an FL framework to enable distributed Android clients to collaboratively train a comprehensive Android malware classification model in a privacy-preserving way. Finally, to adapt to the non-IID distribution of malware on Android clients, we propose a contribution degree-based adaptive classifier training mechanism FedAdapt to improve the adaptability of the malware classifier based on Federated learning. Comprehensive experimental studies on the Androzoo dataset (under different non-IID data settings) show that the FedHGCDroid achieves more adaptability and higher accuracy than the other state-of-the-art methods.<\/jats:p>","DOI":"10.3390\/e24070919","type":"journal-article","created":{"date-parts":[[2022,7,2]],"date-time":"2022-07-02T11:12:35Z","timestamp":1656760355000},"page":"919","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":39,"title":["FedHGCDroid: An Adaptive Multi-Dimensional Federated Learning for Privacy-Preserving Android Malware Classification"],"prefix":"10.3390","volume":"24","author":[{"given":"Changnan","family":"Jiang","sequence":"first","affiliation":[{"name":"Key Laboratory of Beijing Network Technology, Beihang University, Beijing 100191, China"}]},{"given":"Kanglong","family":"Yin","sequence":"additional","affiliation":[{"name":"Key Laboratory of Beijing Network Technology, Beihang University, Beijing 100191, China"}]},{"given":"Chunhe","family":"Xia","sequence":"additional","affiliation":[{"name":"Key Laboratory of Beijing Network Technology, Beihang University, Beijing 100191, China"},{"name":"Guangxi Key Lab of Multi-Source Information Mining and Security, Guangxi Normal University, Guilin 541004, China"}]},{"given":"Weidong","family":"Huang","sequence":"additional","affiliation":[{"name":"Key Laboratory of Beijing Network Technology, Beihang University, Beijing 100191, China"}]}],"member":"1968","published-online":{"date-parts":[[2022,7,1]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"126","DOI":"10.1145\/3417978","article-title":"A Survey of Android Malware Detection with Deep Neural Models","volume":"53","author":"Qiu","year":"2021","journal-title":"ACM Comput. Surv."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"3216","DOI":"10.1109\/TII.2017.2789219","article-title":"Significant permission identification for machine-learning-based Android malware detection","volume":"14","author":"Li","year":"2018","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"4895984","DOI":"10.1155\/2019\/4895984","article-title":"MalDeep: A deep learning classification framework against malware variants based on texture visualization","volume":"2019","author":"Zhao","year":"2019","journal-title":"Secur. Commun. Netw."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"138","DOI":"10.1145\/3264948","article-title":"Your Apps Give You Away: Distinguishing Mobile Users by Their App Usage Fingerprints","volume":"2","author":"Tu","year":"2018","journal-title":"Proc. ACM Interact. Mob. Wearable Ubiquitous Technol."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"235","DOI":"10.1007\/s42486-020-00041-3","article-title":"Demographics of mobile app usage: Long-term analysis of mobile app usage","volume":"3","author":"Tu","year":"2021","journal-title":"CCF Trans. Pervasive Comput. Interact."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1109\/MCE.2018.2851723","article-title":"Fair resource allocation in an intrusion detection system for edge computing: Ensuring the security of internet of Tings devices","volume":"7","author":"Lin","year":"2018","journal-title":"IEEE Consum. Electron. Mag."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"112301","DOI":"10.1007\/s11432-020-2975-6","article-title":"Efficient privacy preserving user authentication scheme with forward secrecy for industry 4.0","volume":"65","author":"Wang","year":"2022","journal-title":"Sci. China Inf. Sci."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"e4172","DOI":"10.1002\/cpe.4172","article-title":"Detection of malicious behavior in android apps through API calls and permission uses analysis","volume":"29","author":"Yang","year":"2017","journal-title":"Concurr. Comput. Pract. Exp."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1455","DOI":"10.1109\/TIFS.2018.2879302","article-title":"Droidcat: Effective android malware detection and categorization via app-level profiling","volume":"14","author":"Cai","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"30996","DOI":"10.1109\/ACCESS.2018.2844349","article-title":"A Novel Dynamic Android Malware Detection System with Ensemble Learning","volume":"6","author":"Feng","year":"2018","journal-title":"IEEE Access."},{"key":"ref_11","unstructured":"Lu, R. (2019). Malware detection with LSTM using opcode language. arXiv."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., and Rieck, K. (2014, January 23\u201326). DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket. Proceedings of the NDSS, San Diego, CA, USA.","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Jerome, Q., Allix, K., State, R., and Engel, T. (2014, January 10\u201314). Using opcode-sequences to detect malicious android applications. Proceedings of the 2014 IEEE International Conference on Communications (ICC), Sydney, Australia.","DOI":"10.1109\/ICC.2014.6883436"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"638","DOI":"10.1016\/j.neucom.2017.07.030","article-title":"DroidDet: Effective and robust detection of android malware using static analysis along with rotation forest model","volume":"272","author":"Zhu","year":"2018","journal-title":"Neurocomputing"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"128","DOI":"10.1016\/j.cose.2018.02.006","article-title":"Auto-detection of sophisticated malware using lazy-binding control flow graph and deep learning","volume":"76","author":"Nguyen","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Zhou, J., Cui, G., Hu, S., Zhang, Z., Yang, C., Liu, Z., Wang, L., Li, C., and Sun, M. (2021). Graph neural networks: A review of methods and applications. arXiv.","DOI":"10.1016\/j.aiopen.2021.01.001"},{"key":"ref_17","unstructured":"Xu, K., Hu, W., Leskovec, J., and Jegelka, S. (2018). How powerful are graph neural networks?. arXiv."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Jiang, H., Turki, T., and Wang, J.T.L. (2018, January 17\u201320). DLGraph: Malware detection using deep learning and graph embedding. Proceedings of the 2018 17th IEEE international conference on machine learning and applications (ICMLA), Orlando, FL, USA.","DOI":"10.1109\/ICMLA.2018.00168"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1027","DOI":"10.1007\/s00500-019-03940-5","article-title":"Deep learning for effective android malware detection using api call graph embeddings","volume":"24","author":"Pektas","year":"2020","journal-title":"Soft Comput."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Singh, N., Kasyap, H., and Tripathy, S. (2020). Collaborative Learning Based Effective Malware Detection System. PKDD\/ECML Workshops, Springer.","DOI":"10.1007\/978-3-030-65965-3_13"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"96","DOI":"10.2478\/popets-2021-0062","article-title":"Less is More: A privacy-respecting Android malware classifier using federated learning","volume":"2021","author":"Galvez","year":"2021","journal-title":"Proc. Priv. Enhancing Technol."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Shukla, S., Manoj, P.D.S., Kolhe, G., and Rafatirad, S. (2021, January 5\u20139). On-device Malware Detection using Performance-Aware and Robust Collaborative Learning. Proceedings of the 2021 58th ACM\/IEEE Design Automation Conference (DAC), San Francisco, CA, USA.","DOI":"10.1109\/DAC18074.2021.9586330"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"8442","DOI":"10.1109\/TII.2020.3043458","article-title":"Fed-IIoT: A Robust Federated Malware Detection Architecture in Industrial IoT","volume":"17","author":"Taheri","year":"2021","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3339474","article-title":"Federated machine learning: Concept and applications","volume":"10","author":"Yang","year":"2019","journal-title":"ACM Trans. Intell. Syst. Technol."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Singh, A.K., and Goyal, N. (2022, January 4\u20138). Android Web Security Solution using Cross-device Federated Learning. Proceedings of the 2022 14th International Conference on COMmunication Systems & NETworkS (COMSNETS), Bangalore, India.","DOI":"10.1109\/COMSNETS53615.2022.9668449"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"(2022). Valerian Rey, Pedro Miguel S\u00e1nchez S\u00e1nchez, Alberto Huertas Celdr\u00e1n, G\u00e9r\u00f4me Bovet: Federated learning for malware detection in IoT devices. Comput. Netw., 204, 108693.","DOI":"10.1016\/j.comnet.2021.108693"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"2031","DOI":"10.1109\/COMST.2020.2986024","article-title":"Federated learning in mobile edge networks: A comprehensive survey","volume":"22","author":"Lim","year":"2020","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1109\/MCE.2020.3048926","article-title":"FedLearnSP: Preserving Privacy and Security Using Federated Learning and Edge Computing","volume":"11","author":"Makkar","year":"2022","journal-title":"IEEE Consum. Electron. Mag."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"1622","DOI":"10.1109\/COMST.2021.3075439","article-title":"Federated Learning for Internet of Things: A Comprehensive Survey","volume":"23","author":"Nguyen","year":"2021","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"100895","DOI":"10.1016\/j.softx.2021.100895","article-title":"PADRES: Tool for Privacy, Data Regulation and Security","volume":"17","author":"Pereira","year":"2022","journal-title":"SoftwareX"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"2231","DOI":"10.1109\/TPDS.2021.3064345","article-title":"Accurate Differentially Private Deep Learning on the Edge","volume":"32","author":"Han","year":"2021","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"key":"ref_32","unstructured":"Mikolov, L.T., Sutskever, I., Chen, K., Corrado, G.S., and Dean, J. (2013, January 5\u20138). Distributed Representations of Words and Phrases and their Compositionality. Proceedings of the 26th International Conference on Neural Information Processing Systems, Lake Tahoe, NV, USA."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"25190","DOI":"10.1109\/ACCESS.2022.3155123","article-title":"Low-Cost CNN for Automatic Violence Recognition on Embedded System","volume":"10","author":"Vieira","year":"2022","journal-title":"IEEE Access"},{"key":"ref_34","unstructured":"Nichol, A., Achiam, J., and Schulman, J. (2018). On first-order meta-learning algorithms. arXiv."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Allix, K., Bissyand\u00e9, T.F., Klein, J., and Traon, Y.L. (2016, January 14\u201315). AndroZoo: Collecting millions of Android apps for the research community. Proceedings of the 13th International Conference on Mining Software Repositories, Austin, TX, USA.","DOI":"10.1145\/2901739.2903508"},{"key":"ref_36","unstructured":"(2019, March 14). VirusTotal: Free Online Virus, Malware and URL Scanner [EB\/OL]. Available online: https:\/\/www.virustotal.com."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Hurier, M., Suarez-Tangil, G., Dash, S.K., Bissyand\u00e9, T.F., Traon, Y.L., Klein, J., and Cavallaro, L. (2017, January 20\u201321). Euphony: Harmonious unification of cacophonous anti-virus vendor labels for Android malware. Proceedings of the 2017 IEEE\/ACM 14th International Conference on Mining Software Repositories (MSR), Buenos Aires, Argentina.","DOI":"10.1109\/MSR.2017.57"},{"key":"ref_38","unstructured":"Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., Cavallaro, L., and Rieck, K. (2020). Dos and Don\u2019ts of Machine Learning in Computer Security. arXiv."},{"key":"ref_39","unstructured":"Pendlebury, F., Pierazzi, F., Jordaney, R., Kinder, J., and Cavallaro, L. (2019, January 14\u201316). TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time. Proceedings of the USENIX Security Symposium 2019, Santa Clara, CA, USA."},{"key":"ref_40","unstructured":"Arivazhagan, M.G., Aggarwal, V., Singh, A.K., and Choudhary, S. (2019). Federated Learning with Personalization Layers. arXiv."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Huang, Y., Chu, L., Zhou, Z., Wang, L., Liu, J., Pei, J., and Zhang, Y. (2021, January 2). Personalized cross-silo federated learning on non-iid data. Proceedings of the AAAI Conference on Artificial Intelligence, Virtual Event.","DOI":"10.1609\/aaai.v35i9.16960"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/24\/7\/919\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T23:41:45Z","timestamp":1760139705000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/24\/7\/919"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,7,1]]},"references-count":41,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2022,7]]}},"alternative-id":["e24070919"],"URL":"https:\/\/doi.org\/10.3390\/e24070919","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,7,1]]}}}