Federated framework detects email malware in benchmarks under non-IID data

A computational framework designed to detect malware in email attachments while keeping data distributed across participating clients achieved 95.75% accuracy and a 94.33% F1-score under non-independent and identically distributed benchmark conditions, according to a study published in Neural Computing and Applications . The system, called HEFL-MD, recorded 96.70% accuracy and a 95.53% F1-score under IID conditions. These results came from experiments using publicly available benign and malware datasets rather than a live enterprise email environment.

Malicious attachments exchanged through enterprise and cloud-based communication platforms remain a significant malware-distribution route. Deep-learning approaches can provide strong detection capability, but centralized training raises privacy, scalability, and deployment concerns when email data are distributed among separate organizations. The proposed framework instead trains a shared visual-learning model across clients without transferring their underlying data to one central location.

Its principal technical problem is statistical heterogeneity: conventional federated-learning methods can lose performance when client data distributions are non-IID, producing client drift and less stable model updates. HEFL-MD addresses this instability with an aggregation strategy that adaptively re-weights client updates according to model divergence. The researchers evaluated the system against Federated Averaging, FedProx, and SCAFFOLD and reported approximately 3–5% higher F1-scores, together with more stable convergence under non-IID data distributions.

These are comparative findings from the tested experimental settings, not evidence that every federated detector will behave in the same way. The framework also includes an explainability component that produces visual explanations for malware predictions. The study abstract describes these outputs as meaningful, but the accessible source material does not specify their resolution, structure, or any user evaluation.

HEFL-MD also narrowed the reported performance gap between federated and centralized training to approximately 1–2%. Together, the results suggest that the tested distributed approach retained most of the centralized model’s performance while producing visual explanations, but the experiments do not constitute a comprehensive assessment of privacy leakage or the framework’s effectiveness against newly encountered email campaigns. Within those limits, the study provides a benchmark-level demonstration of heterogeneity-aware aggregation for email-attachment malware classification.

The authors present the method as scalable, privacy-preserving, and interpretable for distributed email-security applications. Because the evidence presented here comes from publicly available datasets and computational experiments, further validation would be needed to establish performance in operational enterprise settings or against live malware activity.

Subject of Research: Federated visual learning for benchmark email-attachment malware detection under non-IID client data

Article Title: A heterogeneity-aware federated explainable visual learning framework for robust email malware detection

Article References: Shanmuga Priya, G., Mani, V. R. S., & Chellaswamy, C. (2026). A heterogeneity-aware federated explainable visual learning framework for robust email malware detection. Neural Computing and Applications, 38(20), Article 821. https://doi.org/10.1007/s00521-026-12523-z

Image Credits: AI Generated

DOI: 10.1007/s00521-026-12523-z

Keywords: email malware, federated learning, visual classification, non-IID data, client drift, explainable AI, malware detection, model aggregation, privacy-preserving AI, heterogeneity-aware, federated, explainable