The rise of malware in highly interconnected and resource-limited distributed edge networks poses a considerable challenge for traditional security measures. Effective malware detection in these environments requires real-time analysis capabilities, minimal computational overhead on edge devices, strong resilience against adversarial evasion techniques, and the preservation of data privacy across distributed nodes. This paper presents EdgeFence, an innovative framework aimed at lightweight adversarial malware detection within distributed edge networks, utilising Federated Temporal Graph Neural Networks (FTGNNs). EdgeFence represents the dynamic behaviour of processes and system interactions at individual edge nodes through the use of temporal graphs. In contrast to centralised methods, it utilises a federated learning framework, enabling edge devices to work together in training a global detection model by exchanging model updates instead of raw data, which helps maintain data privacy and minimises communication overhead. A significant contribution is the incorporation of Temporal Graph Neural Networks refined for efficiency, adept at capturing sequential dependencies and structural anomalies in dynamic graph data streams produced at the edge. Additionally, EdgeFence integrates adversarial training methods into the federated learning framework to improve the model’s resilience against advanced malware intended to bypass GNN-based detection. Our evaluation shows that EdgeFence attains high accuracy and low false positive rates in detecting various malware families in real-time on resource-limited edge devices, while also demonstrating considerable resilience to adversarial attacks. EdgeFence offers a practical and scalable solution for securing large-scale distributed edge computing infrastructures against evolving cyber threats, thanks to its lightweight architecture and federated learning approach.
Isaac et al. (2026) studied this question.