Federated Learning for Privacy-Preserving Malware Detection in IoT Ecosystems: A Comprehensive Survey

Abstract

The Internet of Things (IoT) devices are rapidly multiplying, which has established a large, diverse attack surface that is vulnerable to the advanced malware attack. Centralized detection mechanisms are fundamentally inadequate in an IoT setting considering that of bandwidth constraints as well as privacy rules and laws.Centralized detection solutions are just not feasible in an IoT environment because of limited bandwidth, computational power, and privacy laws and regulations. The combination of such data privacy and detection effectiveness demands an alternative approach – and Federated Learning (FL) serves just that purpose, by allowing distributed model training without sharing raw data to the central entity within IoT nodes. This survey has a comprehensive and systematic description of privacy-preserving malware detection frameworks specific to IoT environments. We propose a multi-dimensional taxonomy for FL architectures, privacy-enhancing technologies (PETs), malware detection techniques, threat models, and evaluation benchmarks. Attacks such as model poisoning, data poisoning, gradient inversion, and membership inference are analyzed and corresponding defense strategies are summarized. Some of the most important remaining open challenges such as non-IID data distribution, communication overhead, resource heterogeneity, Byzantine robustness, and zero-day malware detection are posed with directions for potentially future research. It provides a comprehensive overview, making it a valuable resource for researchers and practitioners in the fields of federated learning, cybersecurity, and IoT.