ON-DEVICE FEDERATED ANOMALY DETECTION FOR ANDROID SECURITY

This paper proposes an on-device, federated anomaly detection framework for Android applications that enables early detection of malicious and high-risk behaviors without centralizing raw telemetry. The system combines lightweight, energy-aware feature extraction of runtime signals (e.g., permission usage timelines, inter-process communication patterns, network destinations, overlay and accessibility interactions) with a cross-device federated optimization protocol that aggregates model updates instead of data. To protect user privacy and model integrity, secure aggregation and differential privacy are integrated, and defenses against model poisoning, data poisoning, and adversarial evasion are discussed. An implementation is outlined that aligns with modern Android constraints (background execution limits, scoped storage, user consent, on-device inference accelerators), and an evaluation blueprint is presented that jointly measures detection performance, energy, latency, and privacy loss. Deployment recommendations and open challenges for trustworthy on-device AI security are provided.