Dynamic Weighted Federated Learning: A Scalable and Privacy‐Centric Approach to Android IoT Malware Detection

ABSTRACT The rise in malware attacks on Internet of Things (IoT)‐based Android devices has significantly increased cybersecurity risks. To combat these threats, researchers have introduced machine learning (ML) and deep learning (DL) methods. However, the rapid spread of Android devices across diverse geographic areas has resulted in distributed data, rendering traditional methods suboptimal. Centralizing data not only raises privacy concerns but also introduces overhead and scalability issues. To address these challenges, the research community has developed federated learning (FL)‐based systems for Android malware classification, aiming to balance privacy and scalability without compromising effectiveness. In the standard FL paradigm, federated averaging (FedAvg) converges the local models of all participating clients into a global model in each iteration. A notable limitation of FedAvg, however, is that it does not differentiate between the contributions of individual local models, leading to potential performance degradation if suboptimal local models are included. This research introduces a dynamic weighted federated averaging (DW‐FedAvg) mechanism to overcome these limitations. DW‐FedAvg adjusts the weights of each local model based on its performance at the client level. The efficacy of DW‐FedAvg was evaluated using four benchmark datasets in Android malware classification. Preliminary results demonstrate that the proposed methodology outperforms traditional FedAvg and other state‐of‐the‐art techniques in terms of scalability, privacy preservation, and performance metrics such as accuracy, F1 score, AUC score, and FPR score.