FedREVAN: real-time detection of vulnerable android source code through federated neural network with XAI.

Senanayake, Janaka; Kalutarage, Harsha; Petrovski, Andrei; Al-Kadri, Mhd Omar; Piras, Luca

Abstract

Adhering to security best practices during the development of Android applications is of paramount importance due to the high prevalence of apps released without proper security measures. While automated tools can be employed to address vulnerabilities during development, they may prove to be inadequate in terms of detecting vulnerabilities. To address this issue, a federated neural network with XAI, named FedREVAN, has been proposed in this study. The initial model was trained on the LVDAndro dataset and can predict potential vulnerabilities with a 96% accuracy and 0.96 F1-Score for binary classification. Moreover, in case the code is vulnerable, FedREVAN can identify the associated CWE category with 93% accuracy and 0.91 F1-Score for multi-class classification. The initial neural network model was released in a federated environment to enable collaborative training and enhancement with other clients. Experimental results demonstrate that the federated neural network model improves accuracy by 2% and F1-Score by 0.04 in multi-class classification. XAI is utilised to present the vulnerability detection results to developers with prediction probabilities for each word in the code. The FedREVAN model has been integrated into an API and further incorporated into Android Studio to provide real-time vulnerability detection. The FedREVAN model is highly efficient, providing prediction probabilities for one code line in an average of 300 ms.

Citation

SENANAYAKE, J., KALUTARAGE, H., PETROVSKI, A., AL-KADRI, M.O. and PIRAS, L. 2024. FedREVAN: real-time detection of vulnerable android source code through federated neural network with XAI. In Katsikas, S. et al. (eds.) Computer security: revised selected papers from the proceedings of the International workshops of the 28th European symposium on research in computer security (ESORICS 2023 International Workshops), 25-29 September 2023, The Hague, Netherlands. Lecture notes in computer science, 14399. Cham: Springer [online], part II, pages 426-441. Available from: https://doi.org/10.1007/978-3-031-54129-2_25

• Conference Name: International workshops of the 28th European symposium on research in computer security (ESORICS 2023 International Workshops)
• Conference Location: The Hague, Netherlands
• Start Date: Sep 25, 2023
• End Date: Sep 29, 2023
• Acceptance Date: Aug 14, 2023
• Online Publication Date: Mar 12, 2024
• Publication Date: Dec 31, 2024
• Deposit Date: Apr 26, 2024
• Publicly Available Date: Mar 13, 2025
• Publisher: Springer
• Pages: 426-441
• Series Title: Lecture notes in computer science
• Series Number: 14399
• Series ISSN: 0302-9743; 1611-3349
• Book Title: Computer security: revised selected papers from the proceedings of the International workshops of the 28th European symposium on research in computer security (ESORICS 2023 International Workshops), part II
• ISBN: 9783031541285
• DOI: https://doi.org/10.1007/978-3-031-54129-2_25
• Keywords: Systems security; Android applications; Neural networks; Federated learning; Explainable artificial intelligence (XAI)
• Public URL: https://rgu-repository.worktribe.com/output/2271824