SecShield: A Privacy-Preserved Federated Learning Model to Detect Zero-Day Malware Attack

Abstract

The proliferation of Internet of Things (IoT) devices has amplified the attack surface for large-scale cyber threats, with rapidly evolving malware families such as Mirai posing significant detection challenges. Existing side-channel and host-based approaches are limited by poor generalization to unseen variants and the absence of robust privacy protections during training. In this paper, we propose SecShield, a federated deep learning framework for privacy-preserving malware detection in resource-constrained IoT environments. SecShield employs a three-party secure computation model, where clients locally train a shared deep neural network on power side-channel traces and transmit only noisy parameter updates to a central server via an aggregator, preventing raw data exposure. Differential privacy is incorporated by injecting calibrated noise into gradients, mitigating inference risks such as data reconstruction and poisoning attacks. This decentralized architecture enables continuous adaptation to zero-day malware, reduces communication overhead, and ensures robustness against adversarial manipulation. Experimental evaluations on IoT power trace datasets demonstrate that SecShield achieves high detection accuracy over 98% while preserving client data confidentiality and maintaining computational efficiency.