Behavioral Malware Detection Samples with Federated Learning Framework

A paper by Mohammed El-Hajj presents an MLOps framework for behavioral malware detection. The evaluation uses 2.74 million behavioral samples from 104 distinct malware experiments. The framework includes a federated learning architecture tested with up to 104 clients and a real-time drift detection engine.

Use Cases

• Training models for malware detection based on hierarchical behavioral signatures derived from process telemetry.
• Implementing federated learning for privacy-preserving collaborative model training across multiple clients.
• Monitoring and adapting to concept drift in malware behavior using a real-time detection engine with sub-500 ms latency.

Strengths

• Evaluation based on 2.74 million behavioral samples from 104 distinct malware experiments.
• Framework includes a federated learning architecture tested with up to 104 clients.
• Real-time drift detection engine operates with sub-500 ms latency and triggers automated retraining with a mean recovery time of 4.2 minutes.

Limitations

• Column-level documentation is absent; field semantics must be inferred after download.
• The dataset's primary artifact is a PDF file (102.2 KB), which likely contains a description of the framework rather than the raw data samples.
• Architectural projections for scalability to 5,000+ clients are noted as unvalidated future work.

Provenance

Source

Mohammed El-Hajj

Collection Method

Likely collected from malware experiments; specific collection method not detailed.

Freshness

Last updated 2026-05-11 05:28:16; freshness should be verified.