In traditional centralized Android malware classifiers based on machine learning, the training sample uploaded by users contains sensitive personal information, such as app usage and device security status, which will undermine personal privacy if used directly by the server. Federated-learning-based Android malware classifiers have attracted much attention due to their privacy-preserving and multi-party joint modeling. However, research shows that indirect privacy inferences from curious central servers threaten this framework. We propose a privacy risk evaluation framework, FedDroidMeter, based on normalized mutual information in response to user privacy requirements to measure the privacy risk in FL-based malware classifiers. It captures the essential cause of the disclosure of sensitive information in classifiers, independent of the attack model and capability. We performed numerical assessments using the Androzoo dataset, the baseline FL-based classifiers, the privacy-inferred attack model, and the baseline methodology of privacy evaluation. The experimental results show that FedDroidMeter can measure the privacy risks of the classifiers more effectively. Meanwhile, by comparing different models, FL, and privacy parameter settings, we proved that FedDroidMeter could compare the privacy risk between different use cases equally. Finally, we preliminarily study the law of privacy risk in classifiers. The experimental results emphasize the importance of providing a systematic privacy risk evaluation framework for FL-based malware classifiers and provide experience and a theoretical basis for studying targeted defense methods. Due to the popularity of Android devices and their open source, Android users are subject to a wide range of malware attacks. Scientists have used machine learning (ML) to detect new malware and attack vectors. These traditional ML methods require centrally collected user data to train malware classifiers . HoweverTherefore, in this work, we comprehensively analyze the system and adversary model of the FL-based malware classification framework and propose a privacy risk evaluation framework, FedDroidMeter, based on normalized mutual information. In this framework, we design the input and output elements for privacy risk calculation according to the existing privacy threat attack surface, the characteristics of FL-based Android malware classifiers, and user privacy requirements. To verify the effectiveness and applicability of the proposed FedDroidMeter, we use the Androzoo dataset and baseline classification model to measure the privacy risk of the FL-based malware classification system.The experimental results show that our proposed FedDroidMeter can effectively measure the privacy risks of the classification model. It also warns that existing FL-based Android malware classification systems do not provide adequate privacy protection. Adversaries can effectively infer the label and attribute information to the client’s training dataset . In addition, by comparing the input feature type, the setting of the federal hyperparameter, and the setting of the privacy protection parameter, we preliminarily study the law of privacy disclosure risk in the existing classifiers. These experiments and findings highlight the privacy risks faced by existing FL-based malware classification models and the importance of providing a systematic privacy risk evaluation framework. At the same time, it provides experience and a theoretical basis for developers to study the mitigation measures of privacy leakage.The rest of this article is organized as follows. In this section, we first review the latest work in the FL-based malware classification framework field. Second, we introduce existing privacy inference attacks on federated learning Lastly, the latest work of privacy breach evaluation schemes based on federated learning is reviewed, and the limitations and improvement direction of existing privacy breach evaluation schemes under the task of malware classification are analyzed.Existing methods that use ML/DL to classify malware rely on the vast amount of high-quality available data from different clients to train the accurate global model. These models are then distributed to individual clients, or these clients upload their test data to the server for real-time behavior checking and malware classification. However, training data contains private information about user behavior, which will seriously affect user security and privacy once it falls into the hands of hackers .To solve user privacy concerns in deep learning, Google has proposed federated learning, a collaborative learning approach that ensures privacy by storing it locally on the client . In the Taheri  proposedGalvez  presenteHowever, the existing FL-based malware classification schemes only consider the classification performance, communication performance, and robustness of poisoning attacks, and require more consideration and research on the privacy disclosure of malware classifiers. It makes the existing FL-based malware classification scheme unable to ensure user data privacy and make users transparently aware of their privacy risks under the threat of multiple privacy inference attacks. It does not accord with existing privacy protection laws, and hinders user willingness to participate in collaborative training. Therefore, it is urgent to propose a privacy risk evaluation mechanism for an FL-based Android malware classification scheme.There are four types of privacy inference attacks: attribute inference attack (AInf), model extraction attack (MExt), model inversion attack (MInv), and member inference attack (MInf).Member inference attacks are designed to determine whether candidate data belongs to the training dataset of the target model. Shokri et al.  proposedThe attribute inference attack was first proposed by Ateniese . An inteModel inversion is mainly divided into data reconstruction and training class inference. Model inversion was first proposed by Fredrikson  in the tThe ModSteal attack , also known as model extraction, targets the Extract parameters from the target model. Ideally, the opponent will be able to obtain a model with a very similar performance to the target model (the “stolen” model). Tramer et al.  proposedThese attacks have proven to be dangerous in the field of graphics and natural language processing. However, considering the characteristics of input and models in the field of malware classification, as well as the characteristics of Android user demand for privacy, they are different from them. In the FL-based malware classification framework, there has yet to be a thorough study of what user privacy information is contained and the extent to which it is exposed to various inferred attacks, nor has an effective defense scheme been proposed.Therefore, it is urgent to evaluate the impact of various attacks and the degree of privacy leakage in the FL-base malware classification framework to provide support for its corresponding privacy protection scheme.In Reference , the autHowever, these privacy evaluation schemes based on the attack effect cannot provide users with a reasonable privacy evaluation perspective, because attackers are unknowable to users. In the article , the autMost of these previous studies have explored the empirical privacy risks of the ML model from the attacker’s perspective, as shown in To sum up, existing privacy risk evaluation frameworks do not capture the essence of privacy leakage in the system, thus, cannot provide effective evaluation results for users of the federal Android malware classifiers.Therefore, developing a user-oriented privacy risk evaluation framework for FL-based Android malware classifiers is necessary. The evaluation framework allows users to evaluate the potential privacy risks of their training samples throughout the life cycle of the FL-based Android malware classification model. The privacy risk evaluation framework needs to: (1) meet user-oriented privacy requirements; (2) be attack-agnostic; and (3) have an equal comparison between different use cases.The contributions of this paper are summarized below.We comprehensively analyzed the privacy threats in the FL-based Android malware classification system, and defined the sensitive information, observable data, and attacker types in the system; a privacy risk evaluation framework, FedDroidMeter, was proposed to evaluate the privacy disclosure risk of the FL-based malware classifier systematically.We propose a calculation method for privacy risk score based on normalized mutual information between sensitive information and observable data. We use the sensitivity ratio between layers of the gradient to estimate the overall privacy risk, appropriately mitigating the score calculation.We validate the effectiveness and applicability of the proposed evaluation framework on the Androzoo dataset, two baseline FL-based Android malware classification systems, and several state-of-the-art privacy inference attack methods.An FL-based Android malware classification system allows Android clients to keep the malware dataset locally and collaboratively train classification models, which means that any third party cannot access the user’s raw app samples . The fraWe consider an FL-based Android malware classification system that includes one FL server for parameter aggregation and update server, and There are the following stages in the process of federated learning: initialization stage, aggregation stage, and update stage, which are described as follows:In the initialization phase, the FL server assigns a pre-trained global model In the aggregation phase, the FL server collects local gradients of Android client uploads. The global loss function In the update phase, the FL server uses the federated average algorithm (FedAvg)  to obtaiThis process is repeated for both FL server and Android clients until the global model converges. By not requiring direct access to raw training data on Android nodes, this mode significantly reduces the risk of privacy disclosure.This section presents several assumptions regarding adversaries who may attempt to infer privacy from the FL-based Android malware classification system, as shown in (1) Role and capability of attack: Since we want to evaluate the worst case of privacy disclosure, we set the attacker as the FL server, which has sufficient auxiliary knowledge (2) Target of the attacker: The attacker’s target is to infer the sensitive information of the app training sample of the victim client from the observable data in the FL-based malware classification framework through the privacy inference attack method.(3) Attack methods: According to the summary in Next, we give formal definitions of the four most advanced inference attacks.MemInf)(1) Membership Inference attack (Membership inference attack aiming to detect whether or not a target sample was used to train a target ML model AttrInf)(2) Attribute inference attack (3) Model-stealing attack (4) Model inversion attack  An endless stream of privacy inference attacks against FL exists. However, the existing framework does not consider the indirect privacy disclosure caused by these attacks, leading to severe threats to users of app samples that provide training. Due to the variety of privacy inference attacks, and the complexity and opacity of the FL Android malware classification model, it is difficult for users to know what private information is leaked in the classification system and the source of privacy leakage.(2) The FL-based Android malware classifier lacks a user-oriented privacy risk evaluation mechanism, so users cannot understand the degree and distribution of privacy disclosure risk in the classification system. It also makes privacy protection mechanism design for FL-based malware classifiers lack theoretical guidance and basis. Considering the characteristics of the FL-based Android malware classification system and the privacy needs of users, the existing privacy risk evaluation indicators and methods cannot provide effective evaluation results for the system.These issues increase user privacy concerns and violate existing privacy laws , limiting the application and development of the federal Android malware classifier. It prompts us to deeply analyze the actual threat of privacy inference attacks to FL-based malware classification systems and user privacy needs, and develop a user-oriented privacy risk evaluation method for the FL-based Android malware classification system.The above issues increase user privacy concerns and violate existing privacy laws , limiting the application and development of the federal Android malware classifier. It prompts us to deeply analyze the actual threat of privacy inference attacks in FL-based malware classification systems and user privacy needs. Furthermore, we develop a user-oriented privacy risk evaluation method for the FL-based Android malware classification system.The evaluation framework allows users to evaluate the potential privacy risks of their training samples throughout the life cycle of the FL-based Android malware classification system. The privacy risk evaluation framework needs to meet three principles: (1) User-oriented privacy requirements; (2) Attack-agnostic; and (3) Equal comparison between different use cases, as shown in In this section, we first introduce the components and functionality of FedDroidMeter, a proposed privacy risk evaluator for FL-based Android malware classifiers. Then, we introduced the design of FedDroidMeter’s input and output, respectively. The list of abbreviations and mathematical symbols used is given in To solve the limitations of the existing framework proposed in The system model for privacy risk evaluation in this article (as shown in (1) FL server: the FL server is a central server with strong computing power and rich computing resources. FL server contains two mechanisms, which: (a) initialize the global model and send the optimal global initialization model parameters to all Android clients; and (b) aggregate the gradient uploaded by Android clients until the model converges.(2) Android client: the Android client has some samples of various types of malware, which is used for training on the model issued by the FL server, and then generates an updated gradient and sends it back to the server.(3) FedDroidMeter: FedDroidMeter is a privacy risk evaluator deployed on the client to evaluate the privacy risks of the shared information that the client returns to the server. It takes observable data, adversary targets, and other parameters as input; the output of FedDroidMeter is the client’s privacy risk score.The workflow of the FedDroidMeter comprises the following four steps:(1) The Android client uses the initial model parameters (2) The FedDroidMeter (in Android clients) collects privacy-related elements in FL-based malware classifiers to evaluate the privacy risk score (3) The FL server aggregates the updated gradient (4) The FL server sends new optimal global model parameters As described in In the deep-learning models performing FL-based Android malware classification, given the training set of app samples, the shared gradient (based on the training app samples), the classification model structure and parameters, and the adversary (non-specific) information,Question 1:Where are the sources of privacy leaks?Question 2:What kind of private information will be leaked?Question 3:What determines the occurrence of privacy leaks?Question 4:What is the level of privacy leakage risk?Question 1).To evaluate privacy risks, the inputs to the evaluator should be relevant variables that reflect the underlying causes of privacy breaches in the system. Therefore, as shown in FedDroidMeter as shown in Formula (8):In a given Android malware classification model, the adversary uses relevant auxiliary knowledge and privacy inference attack models to infer sensitive information about users in public data. Therefore, we designed the input elements of Among them, the adversary’s resources in the input setting are sufficient app sample sets with the same distribution as the inferred target client as auxiliary knowledge. In addition, the adversary has unconstrained computing power (from the perspective of privacy in information theory). In addition, the adversary can use a variety of advanced privacy inference attack models (selecting the most threatening results). These settings are used to evaluate the worst-case privacy risk while also obtaining attack-agnostic and effective evaluation results to ensure users’ privacy requirements. It should be pointed out that the attacker’s setting is also used to proofread the validity of the privacy score. In addition, Question 2).In this section, we provide a detailed definition and analysis of the sensitive information leaked to the attacker in the system, considering the various privacy threats brought by the attacker, the privacy requirements of Android users for training samples, and the characteristics of the FL-based Android malware classifier.  The functional class (2) The malware class (3) The input features (4) The parameters of the trained global Android malware classification model First, the function category Second, the input features of the training app samples are sensitive APIs, permissions, intentions, and bytecodes extracted from the app samples , which dFinally, in the FL-based Android malware classification system, the global classification model is jointly trained by all clients, which can only further infer the general statistical information for all participants but cannot infer the information of specific clients. Therefore, the attribute privacy of users is not violated either.In summary, in the FL-based Android malware classification system and its corresponding threat model, the sensitive information is the functional category We find the observable data of attackers in each phase by analyzing the characteristics of the FL-based Android malware classification system in the whole cycle , since the data-processing phase and prediction phase in the FL-based malware classification framework is carried out on the user device .Therefore, the attacker has no observable data source that can be used for a privacy inference attack in both the data-processing and prediction phases. Thus, we focus on analyzing the observable data sources of the classification framework in the training phase.In the training phase, the client samples the local user’s app sample set to obtain a batch of samples for training. The client then uploads the locally trained updated gradients. Among them, batch sampling rules for training can be roughly divided into three categories: random, systematic, and hierarchical.Random sampling: The user randomly samples a certain amount of data from the dataset, which can be divided into two types: put back and not put back.(1) Sampling method of putting back. Sample sampling probability as shown in Formula (9):(2) Sampling method without putting back as shown in Formula (10).System sampling: The user divides the overall dataset into several small parts in order, then extracts the Hierarchical sampling: Users divide data into several categories, then randomly select a certain number of samples from each category, and then combine these samples.The training gradients generated by any two batches, whether randomly or systematically sampled, correspond to different subsets of app samples. Therefore, the attacker needs to run the analysis (train the inference model) in two separate batches to maximize inference accuracy. Thus, the observable data source for the attacker is a batch of generated update gradients. Accordingly, our metric framework computes the privacy risk score for the gradient of each batch separately.FedDroidMeter as shown in Formula (11):Based on the above analysis, the input of the privacy risk evaluator The evaluator’s output is the current system’s privacy risk level, calculated by various attributes  about the system and adversaries. Furthermore, to quantify the level of privacy risk, we need to design an appropriate privacy risk meter indicator and the corresponding calculation method of privacy risk score.According to the three principles in the design objective of the privacy evaluation method, we choose the appropriate evaluation indicator. The principle of privacy requirements for users means that privacy indicators should reflect the disclosure of attribute privacy in the worst case. The principle of equal comparison between attack unknowability and instance means that the privacy evaluation indicator must capture the essential cause of privacy disclosure to reflect the degree of privacy risk in a way independent of the attack and use case. Therefore, we must dig deep into privacy disclosure’s essential causes to select effective evaluation indicators. From Question 3). It should be noted that the classification model of Android malware considered in this paper is a neural network (such as DNN and CNN). Therefore, the relationship between the observable data source (training gradient) and the adversary target  is highly nonlinear, and it is tricky and impractical to directly derive the analytical mapping relationship from the gradient to the corresponding sensitive information.Furthermore, the essential cause of privacy disclosure is a correlation between the object of the sensitive information (which the adversary is interested in) and the observable data source so that the adversary with a specific ability can use it for privacy inference .Based on the adversary threat model analysis and sensitive information in the classification system mentioned above, the corresponding methods of sensitive information in the adversary inference classification system are attribute inference attacks and label inference attacks. In essence, both attack methods use gradient variation rules to distinguish the existence of attributes and labels. The more significant the mutual information between the gradient and the sensitive information, the more accessible for the adversary to infer the sensitive information from the shared gradient (Answer the n types) and the malware tags m types) of the app and the release gradient Therefore, a privacy risk score based on normalized mutual information between sensitive information and gradient is introduced to represent the degree of privacy disclosure in the training process of the classification system, as shown in Formula (12):If the privacy risk score This section gives the calculation method and process of the privacy risk score. First, the mutual information between The exact computation of  article  and reprThen, we used the Donsker–Varadhan (DV) of KL divergence to express the expression of mutual information, which became an expected upper bound, and then performed sampling estimation, as shown in Formula (15):terature .It follows from the definition of mutual information that the range of the value as shown in Formula (16):Furthermore, we define the normalized mutual information as shown in Formula (17):equality ).It should be noted that the shared gradient of the Android malware classifier is a high-dimensional variable, which leads to a massive amount of calculation for the estimation of mutual information, and a large number of samples are needed for accurate fitting. Therefore, to reduce the calculated dimension of the privacy risk score in Formula (11), we combine the sensitivity that is more convenient for the calculation to simplify the amount of calculation appropriately.Definition 4 .Given function Among them, Sensitivity is a measure that quantifies how much a slight change in the corresponding input data affects the model’s output. Suppose the gradient is not sensitive to the change in the input data. In that case, it will be more difficult for the adversary to classify the sensitive information of the input data, thus making the inference attack less successful. Therefore, the sensitivity reveals the risk of information leakage from another perspective, and the sensitivity ratio between different layers also approximately reflects the proportion of the privacy risk between them. At the same time, the sensitivity can be constrained by the clipping norm of the gradient, which is easy to calculate .Therefore, we use the ratio of sensitivity of different layers, combined with mutual information, to represent the score of privacy risk, as shown in Formula (19):Algorithm 1: Privacy Risk Evaluation Mechanism of FedDroidMeterinputGradient of client OutputPrivacy risk score 1:Calculate mutual information of sensitive information 2:Calculate normalized mutual information of sensitive information 3:Calculate sensitivity of the entire gradient 4:Calculate privacy risk score 5:Return privacy risk score 6:endIt can be seen from Formula (19) that by combining the sensitivity ratio, the calculation of the privacy score only needs to calculate the gradient of the In this section, we first introduce the datasets and data settings used in the experiment. Then, we give the relevant setup of the experiment, including the model structure and training details. Next, we introduce metrics to evaluate the effectiveness and applicability of privacy scores. Then, we systematically evaluate the effectiveness of privacy scoring on the Androzoo dataset and baseline classification models; Then, we evaluate the applicability of privacy scores in different use cases by setting different hyperparameters of the model and privacy parameters. Finally, we discuss the experimental results and preliminarily analyze how the privacy risk changes under various hyperparameters of the model and privacy parameter settings.To test the performance of the model and algorithm, we built a dataset from the open-source project Androzoo , which hTo verify the effectiveness and applicability of the proposed privacy score, we choose FedIIoT  and FedRAmong them, the main task of the classifier is set as Android malware classification , and the sensitive attributes are set as 10 app function categories.For the FL training, we set ten clients, overall training round T = 320, local training epoch = 1 for clients, and the optimizer of SGD. We evaluated the experiment on an Intel Golden 6240 CPU and an NVIDIA A100 GPU. FL-based Android malware classifiers and privacy risk evaluation methods are implemented in PyTorch.Aiming at the privacy risk of users’ sensitive information in the FL-based malware classification framework, we choose the attribute inference attack model proposed in ,23,30 toThe auxiliary dataset of the adversary is whole app datasets, and the attack model is trained  using the updated gradients generated  from the auxiliary dataset. Finally, the attack model tests the effect of its inference attack on the gradients generated from the attacked client’s data.In this section, we introduce the metrics to evaluate the effect of privacy inference attacks, the effect of malware classification, and the effectiveness (principles (1) and (2)) and applicability (principle (3)) of privacy scores.The first metric we evaluate is the effect of the attacks, which is the threat degree by privacy inference attack, which is the average F1-score (20 inference experiments) of sensitive information inferred by inference attack. The description of the F1-score is shown in In a real scenario, the configuration of the attacker is not known. Therefore, to verify the worst-case privacy risk, we choose the maximum F1-score of the inferred attack as the measure of the attack effect in the test results of various tuned attack models .Previous papers ,35 have Finally, we evaluate its applicability using the Pearson coefficient between the privacy score and the inference F1-score of the inferred attack in different model parameters, different model structures/inputs, and different settings of privacy parameters (to generate different use cases).In this section, to verify the effectiveness of the privacy score of FedDroidMeter in this paper, we systematically evaluate the privacy risk of the baseline federal malware classifier, FedIIoT , and FedSHAPR measures privacy risk based on the model utility of training samples. Clustering distance-based methods apply the clustering distance of training samples for privacy risk evaluation.At the same time, we perform several attack models described in It can be seen that in the early training phase, the F1-score of the attribute inference attack shows a slow decreasing trend, the F1-score of the label inference attack shows an increasing trend, and the overall F1-score shows an increasing trend.In the middle of training, the F1-score of the attribute inference attack shows a slow decreasing trend, while the F1-score of the label inference attack gradually reaches the peak and starts to decrease. The overall F1-score showed a gradual decline trend.In the later stage of training, the F1-score of both the attribute and label inference attacks gradually flattens out. The overall F1-score also gradually leveled off.This tendency is caused by the change in model state during training. At the beginning of training, the classification model is more sensitive to app samples because it has “seen” fewer samples and “remembers” more information in app samples. With the increase of training samples, the model’s generalization ability is enhanced, so the memory ability of the sample information gradually decreases and tends to be stable. Therefore, the opponent’s difficulty in inferring attribute information from the gradient is gradually increased, i.e., the privacy risk of attribute information is gradually reduced. In addition, the fitting degree of the model to the label category was low at the beginning of the training and then gradually increased and tended to be flat. Therefore, the opponent’s difficulty inferring the label from the gradient also experienced a change law of first increasing and then decreasing.At the same time, as can be seen in Furthermore, we evaluate the effectiveness of our scoring method in estimating the privacy risk between different layers of the neural network. It should be pointed out that SHAPR and the clustering distance-based method only support the overall privacy risk evaluation of the model rather than the fine-grained privacy risk evaluation of different layers. Therefore, we only show the effects of FedDroidMeter’s privacy risk score. As shown in In the FedIIoT, the F1-score of privacy inference attacks near the first and last FC layers is high, while the F1-score of other layers is low. In the FedRAPID, the F1-score of privacy inference attacks near the last Conv layer, and the output FC layer is higher. Meanwhile, in the gradient of different layers of the two models, the privacy risk score of FedDroidMeter proposed by us closely tracked the F1-score (Pearson correlation coefficient is as high as 0.908) of the privacy inference attacks.In addition, we analyzed the different processing mechanisms of the FC layer and Conv layer to the characteristics of malware that lead to the difference in the risk distribution. In the FedRAPID, the first several Conv layers convolved the features of malware , so a complete feature view could not be obtained. Ultimately, all local features are integrated by the FC layer after the Pooling layer so that a more complete feature view is obtained, and higher privacy risks are encountered. However, in the FedIIoT, the first FC layer encodes all input features uniformly (fully connected), thus offering a more complete view of the original sensitive information. Hence, this layer has a higher privacy risk. In addition, the last layer of the two classification models is the FC layer. As the output layer, the FC layer has more label information, so the privacy risk is high.Therefore, our proposed FedDroidMeter is still effective for privacy risk evaluation at different gradient layers .To sum up, the proposed privacy risk scoring mechanism, FedDroidMeter, can effectively capture privacy risks in the training process and meet principles (1) and (2).In this section, we apply the privacy risk scoring mechanisms to different use cases for an equal privacy risk comparison to verify their applicability.In our experiments, we construct three types of different use cases with different FL hyperparameter settings, which are different batch sizes , different learning rates , and the different number of clients . To compare the applicability of privacy scoring mechanisms to different use cases, we perform privacy risk scoring and privacy inference attacks on these use cases and analyze their correlation. The experimental results are shown in It can be seen that when the batch size increases from 2 to 128, the F1-score of privacy inference attacks decreases continuously, as shown in The Pearson coefficient of privacy score based on clustering distance and privacy inference attack F1-score was 0.73, lower than that of FedDroidMeter (Pearson coefficient was 0.92). This is because the privacy score based on clustering distances captures changes in sample distances caused by the increase in the batch and, in turn, changes in privacy risks along the way. However, because it does not consider the content of sensitive information in samples, the effectiveness of the evaluation is inferior to that of FedDroidMeter. In addition, since the score of SHAPR is based on the average utility of each sample, it is less affected by the batch size. Therefore, SHAPR cannot effectively capture the difference in privacy risks in different batch-size use cases.The F1-score of the privacy inference attack keeps increasing when the learning rate increases from 0.004 to 0.03, as shown in The Pearson coefficient of the F1-score of privacy inference attacks and SHAPR was 0.62, lower than that of FedDroidMeter (Pearson coefficient was 0.95). This is because the SHAPR score is based on the utility of the sample to the model. In increasing the learning rate, the model utility gradually increases within a reasonable range. Then, the training accuracy decreases due to the high learning rate, resulting in a decrease in the SHAPR score. However, in the process of increasing the learning rate, because the learning degree of the model to the sample increases, the risk of leakage of sensitive information from the gradient increases. FedDroidMeter’s risk score is based on the mutual information of sensitive information in the gradient, thus correctly tracking this risk trend and giving a more effective risk score.In addition, the privacy score based on clustering distance only considers the distance of samples. It is not affected by the learning rate, so it is constant and cannot effectively assess the privacy risk of these use cases.It can be seen that when the number of clients increases from 1 to 12, the F1-score of privacy inference attacks decreases continuously, as shown in In addition, we build two different types of use cases for different privacy protection parameter settings: different noise scale = , and different clipping norm of gradient . They are the critical parameters in the differential privacy protection mechanism, which adds noise to the model parameters to limit the adversary’s inference to sensitive information.As the noise scale increases from 0.1 to 3.5, the F1-score of the privacy inference attack decreases continuously, as shown in The Pearson coefficient of SHAPR’s privacy score and privacy inference attack F1-score was 0.83, lower than that of FedDroidMeter (Pearson coefficient 0.93). This is because the SHAPR score is based on the utility of the sample to the model. When the noise increases within a specific range, it increases the accuracy of the model , so the model utility gradually increases, and the SHAPR score increases. Then, since the noise variance gradually exceeds the original gradient’s variance, the model utility decreases, and the SHAPR score decreases. However, in the process of increasing noise, the privacy risk is constantly reduced due to the adversary’s increasing difficulty in obtaining sensitive information in the gradient. FedDroidMeter’s risk score is based on the mutual information of sensitive information in the gradient, thus correctly tracking this risk trend and giving a more effective risk score.In addition, privacy scores based on clustering distances only consider the distance of samples. They are not affected by the noise applied on the gradient, so they are constant and cannot effectively assess the privacy risk of these use cases.In The Pearson coefficient of the F1-score of privacy inference attacks and SHAPR was 0.86, lower than that of FedDroidMeter (Pearson coefficient was 0.93). Especially in the range of 6–20, the SHAPR score has a poor ability to track privacy risks. This is because the small norm within the appropriate range plays a certain role in enhancing the model’s generalization and improving the model’s practicability, resulting in the score of SHAPR does not monotonically increase with the increase of the gradient clipping norm. However, with the increase of gradient clipping norm, the adversary’s ability to acquire sensitive elements is improved. On the other hand, FedDroidMeter’s risk score is based on the mutual information of sensitive information in the gradient and thus correctly tracks this trend. In addition, since the change in gradient clipping norm does not affect the clustering distance of training samples, the privacy score based on clustering distance is constant. It cannot capture the difference in privacy risk between different use cases.Furthermore, to test the suitability of the privacy scoring mechanism for use cases with different model architectures and input characteristics, we exchange the input characteristics of (FedIIot) and FedRAPID and add Gaussian noise  as a supplement to the four sets of use cases. The results of the test are shown in By comparing the F1 scores of privacy inference attacks of CNN and the DNN (FC) model, it can be found that DNN has a higher risk of privacy disclosure. According to our preliminary analysis, this is because the feature processing of CNN in the first few layers is local and separated, resulting in the dispersion of sensitive information in the gradient, which is difficult for opponents to use for inference.By comparing the F1 score of the privacy inference attack of bytecode and the input feature of API-Intent-Permission, we can find that the input feature of API-Intent-Permission has a lower risk of privacy disclosure. We hypothesize that this is because the input feature of API-Intent-Permission contains less semantic information about the app’s functional category (sensitive information) than the bytecode feature and thus is more easily recognized by adversaries.The F1 score of privacy inference attacks of the model shows that the F1 score of privacy inference attacks of DNN is higher.We then analyzed the correlation between the privacy risk scores for six use cases and the F1 scores for privacy inference attacks, as shown in A synthesis of the above experimental analysis, the proposed privacy risk evaluation mechanism, and FedDroidMeter can apply well to different evaluation use cases and meet the three principles.In the above experiments, we tested different FL parameters, different privacy parameters, different model settings, and input features to prove the effectiveness and applicability of our proposed privacy risk evaluator FedDroidMeter. By comparing the evaluation effect of the two baseline evaluation mechanisms, the evaluation method proposed in this paper can better capture the essential cause of privacy disclosure in the system. Evaluation methods based on coarse-grained model utility (without taking sensitive information into account) or without considering the model state’s impact are insufficient to provide effective evaluation results.In addition, through the evaluation test of multiple settings, we preliminarily summarized the rules of privacy risk in an FL-based Android malware classification system: (1) When the model performs normal classification function, privacy risk is negatively correlated with learning rate and gradient clipping norm; the number of clients, batch size, and noise scale are negatively correlated. (2) Regarding model structure and input characteristics, CNN seems to have less leakage risk than DNN; Bytecode seems to have less privacy risk than API-Intent-Permission. The more rigorous experimental and theoretical proof is beyond the scope of this paper, which will be considered in future research work. (3) The distribution of privacy risks in space and time is uneven. In spatial dimensions, the first FC layer near the last classification layer and the front end have the highest privacy risk. In the time dimension, privacy risk presents a trend of first increasing and then decreasing, which is related to the fitting state of the model.It should be noted that our privacy risk score is calculated from the normalized information of the sensitive information and the gradient. It is essentially the amount of information, not the standard probability value. Therefore, our privacy score is not directly equal to the F1 score of the opponent’s inferred attack but is positively correlated with each other. How to strictly track the F1-score of adversary’s inferred attacks, i.e., how to express privacy score as a strict probability representation (probability upper bound) of the F1-score of adversary’s inferred attacks, is beyond the scope of this paper and will be the direction of improvement in the future.Finally, in light of these experimental findings, we highlight the significant privacy risks in existing FL-based Android malware classification systems. At the same time, it also emphasizes the necessity of privacy assessment and protection measures based on scene characteristics and user privacy needs.In this work, we propose FedDroidMeter, a privacy risk evaluation framework based on normalized mutual information according to actual scenario characteristics and user privacy requirements, to evaluate the risk of the indirect information leakage of FL-based Android classifiers. Experimental results on the Androzoo dataset and the baseline FL-based malware classification model show that our proposed FedDroidMeter can effectively measure the privacy risk of classification models. We also warn about the severity of privacy risks in existing federal malware classification frameworks (privacy inference F1-scores up to 0.8). Furthermore, we evaluate the privacy risk of different use cases with different FL parameters and privacy protection parameters and verify the applicability of our risk evaluation method to different use cases. At the same time, we observe and analyze the law of privacy risk of existing classifiers in the setting of different parameters in the discussion of experimental results. The experimental results and findings highlight the importance of providing a systematic privacy risk evaluation framework for FL-based Android malware classifiers and provide empirical and theoretical grounds for developers to investigate targeted defense methods.The privacy scoring mechanism proposed in this paper is aimed at the indirect privacy threat of privacy inference attacks based on neural networks. The evaluation of other unknown types of privacy threats is out of the scope of this paper and will be used as the expansion direction of FedDroidMeter in the future. At the same time, we plan to explore ways to optimize the computational efficiency of our privacy scoring mechanism to facilitate its deployment and use in federal malware classification systems. Furthermore, we explore the privacy defense mechanism based on privacy score.


COVID-19 pandemic provides an opportunity to investigate how a new and long-lasting threat affects public risk perception and social distancing behavior, which is important for pandemic risk management and recovery of the tertiary industry. We have found that the mechanism that perception decides behavior changes over time. At the beginning of the pandemic, risk directly shapes people’s willingness of going out. But under a persistent threat, perception no longer plays the direct role of shape people’s willingness. Instead, perception indirectly influences the willingness by shaping people’s judgment about the necessity of traveling. Switching from direct to indirect influence, perception’s effect is enlarged, which partially prevents people from returning to normal life even if the governmental ban is removed in a zero-COVID community. Individuals' perceptions of objective issues inevitably affect their attitudes and behaviors toward objective issues. When an accident occurs, such as the Fukushima nuclear power accident4, the air pollution incident5, etc., risk perception is often incorporated into the management decision-making process. On the one hand, research on risk perception, which focuses on the changes in people's perception of risk before and after the accident, can promote risk communication and provide decision-making basis for risk management. On the other hand, it can provide guidance for formulating health intervention methods according to individual characteristics, so as to conduct risk management. Whether the risk perception affect individual choices by a static mechanism from the first day when the risk appears is a question that has not been sufficiently answered. It has been broadly discussed through which path the risk perception impacts the behaviors of individuals. However, most discussed risks such as the nuclear-power risk have been existing for a long time. It is reasonable to assume that the functional relation between the risk perception and individual choices is time-stable.Risk perception is a concept used to describe people's attitudes and subjective judgments about a series of risks8. The COVID-19 pandemic was discovered in Wuhan in December 2019, and then quickly spread globally. Although Wuhan was lifted from control on April 8th, 2020 when the local cases were cleared, the pandemic is still raging around the world. And some researchers have proposed that pandemic-level pandemic cycles may occur more frequently in the near future10. In China, strict isolation and control measures were taken whenever the epidemic spreads repeatedly, which has had a huge impact on the tertiary industry 12. It has been demonstrated that the risk perception suppressed the willingness of individuals to travel during the pandemic15. Meanwhile, government policies increase the perceived risk and further reduce the frequency of public travel based on the protective action decision model17. It implies that risk perception can have a significant direct effect on behavioral intentions with a direct effect on behavior both during this COVID-19 outbreak19 and in the post-pandemic period20. However, the pathways through which the risk perception affects individual choices may change with time, which requires further investigation21. Similarly, it is also unclear whether government policies affect the risk perception by an innovative mechanism when a new threat occurs. Multiple studies have analyzed how government risk management shapes public risk perception16. However, few of them have examined whether the mechanism is changing over time. It is necessary to reveal the mechanism of development in the chain linking the government risk management and the choices of individuals. Thus, the 2020 COVID-19 pandemic is one of the first opportunities to investigate how an ongoing threat affects perceptions and behaviors, which is also extremely important for understanding the relationship between human perception and the spread of the pandemic. In this study, a retrospective questionnaire survey was conducted to analyze the functional relation between government risk management and public risk perception and their choices.However, it could be different for some special risks. For instance, the risk of infection during the COVID-19 pandemic is a new but long-lasting threat. Our understanding of the risk innovates with the development of the pandemic. Unlike other accidents, the pandemic has the characteristics of long duration, global spread, large impact, and uncertaintyWe used a retrospective questionnaire to survey three aspects, including personal basic information, risk perception survey, travel willingness survey to six places during four stages, including Before-pandemic, Before-Lockdown (at the outbreak of pandemic), Lockdown-lifted (when the COVID cases were decreasing with the zero-COVID policy), and Post-pandemic (1 year after the Lockdown-lifted when the areas were without COVID cases)  to estimate the factors affecting willingness and identify the main influencing factors , and living service places. The family population affected the willingness to restaurants and outdoor leisure places. The willingness to leisure places (indoor and outdoor) and living places were also affected by the vaccine. Sport places were less affected by demographic factors. The influence of demographic factors on perception found in previous studies varies as wellFigure It also demonstrated the change in the pathways through which public risk perception influences their behavior. Although risk perception always plays a decisive role when individuals make mobility decisions, the influencing pathways are different between the pandemic outbreak and the zero-COVID environment. However, when the environment is zero-COVID, the influence of perceived risk on willingness has changed from direct influence to indirect influence through necessity. The impact of risk perception on the necessity and the impact of necessity on willingness are both strong. Moreover, we found that one unit of risk perception has a stronger blocking effect on the willingness in the zero-COVID environment than during the outbreak.The correlation analysis of perceived risk, necessity, and willingness changed from stage2 to stage4  is restored.32. However, the above analysis demonstrates that the mechanism of risk perception deciding the people’s mobility was innovative during the pandemic, and it contributed to the long-lasting voluntary social distancing. Our discoveries stimulate future studies on the change of the mechanism that the risk perception determines the behavior. For instance, it is necessary to examine whether the change was a side effect of the accident on psychology. How does the change interact with the digital transition of society? All these issues about the new observation of the mechanism that risk perception determines the behavior is necessary for us to deepen our insights on the psychological effect of the risk, and the associated social consequences.Our results reveal a novel dimension of the study of risk perception beyond the rational and emotional motivations. We suggest the change in the mechanism of risk perception influencing the willingness is a novel direction for the study of human risk perception and the associated impacts. In-depth studies are still required on why the risk-based decision-making mechanism has changed. The majority of the current discussion about risk perception mainly focuses on either rational tradeoffs or emotional behavior such as information nudges33, in our study analysis due to the limitations of our study design. Further research can be designed and carried out in the future. In addition, our research data are mostly subjective, and the sample size is more biased toward people with high education, and subsequent research can be combined with objective location data such as GPS or POI for site experiment verification analysis.Limitation also exists in this study. Due to the length limitation, the questionnaire in this study used only one question for each perception dimension. And there are indeed a very large number of factors that can influence risk perception and behavior, we did not include some other factors, such as psychological constructsSupplementary Information.


This paper describes a design process for a universal development kit based on an analog computer concept that can model the dynamics of an arbitrarily complex dynamical system up to the fourth order. The constructed development kit contains digital blocks and associated analog-to-digital and digital-to-analog converters (ADCs and DAC), such that multiple-segmented piecewise-linear input–output characteristics can be used for the synthesis of the prescribed mathematical model. Polynomial input–output curves can be implemented easily by four-quadrant analog multipliers. The proposed kit was verified through several experimental scenarios, starting with simple sinusoidal oscillators and ending with generators of continuous-time robust chaotic attractors. The description of each individual part of the development kit is accompanied by links to technical documentation, allowing skilled readers in the construction of electronic systems to replicate the proposed functional example. For this purpose, the electrical scheme of the hybrid analog computer and all important source codes are available online. The construction of chaotic oscillators has been a favorite topic of analog design engineers and enthusiasts for many decades. The unique properties of continuous-time chaotic signals strongly motivate researchers to develop generators of chaos that are robust with respect to variations in fundamental circuit parameters and non-ideal intrinsic properties of the used active elements. The chaotic oscillators discussed in this paper can be understood as lumped electronic systems where output voltages or currents represent a steady state that is extremely sensitive to tiny changes in initial conditions. These systems exhibit a continuous broad-band frequency spectrum and produce dense strange attractors with a prescribed geometrical shape. These Based on the complete knowledge of the mathematical model, which involves both ordinary differential equations and numerical values of internal parameters are known, many systematic approaches can result in the circuitry implementation of a chaotic oscillator containing commercially available components only. This paper focuses on one straightforward method that has been known for decades: the analog computer concept. The authors’ main aim is to provide a detailed cookbook for constructing a maximally universal development kit based on the integrator block schematic of a general class of fourth-order dynamical systems. This universality includes arbitrarily shaped polynomial output-input functions up to the fourth order, a nonlinear transfer function with digitally controlled slopes of the piecewise-linear segments, as well as the number and positions of breakpoints, variable complexity of initial state equations , and the choice of initial conditions  that can be imposed into the circuit. Interested readers will be directed to internet storage sites where all technical documentation can be found, including layouts of individual printed circuit boards, lists of passive and active components, design rules, etc.This paper is organized as follows: The following section guides readers through a carefully selected collection of papers published on the topic of modeling deterministic nonlinear dynamics via electronic circuits, with particular emphasis on the analog computer concept. The third section discusses the fundamental composition of the development kit, including descriptions of the analog and digital parts, as well as the interfaces between individual functional blocks. The fourth section deals with the construction of the printed circuit board, providing tables with component lists and discussions of design requirements. The fifth section is full of demonstrations, beginning with mathematical models and ending with captured oscilloscope screenshots. This section compares theory and practice, showing excellent agreement between the two. Finally, a few concluding remarks are presented, which mainly focus on additional possible improvements of the proposed functional example.One of the earliest lumped chaotic systems was named after its inventor, Prof. L. O. Chua, and was first realized in the early 1980s. This system is still considered one of the simplest circuitry realizations in terms of total component count. It consists of a third-order passive ladder immittance and a five-segment odd-symmetric piecewise linear (PWL) resistor ,3. AfterThe parallel connection of a higher-order two-terminal immittance and a nonlinear resistor is used in other implementations of lumped chaotic systems. For example, reference  shows thAn analog computer can be thought of as an electronic circuit that directly solves a set of first-order ordinary differential equations. Differentiation is typically achieved using a lossless integrator on the right-hand side of the differential equations; egrators ,13,14. Aegrators . Of couregrators . The integrators . The autLet’s start with the simplest examples of integrator-based chaotic oscillators. Reference  demonstrThe pure concept of an analog computer can be found in many papers dealing with the design of chaotic systems. For example, a step-by-step description of a chaotic oscillator based on a given set of ordinary differential equations is provided in . There, In cases where the nonlinearity has a very complicated shape, its realization using discrete analog components can be difficult, and even impossible. For example, in , the autAn extension of the integrator block schematic for arbitrary-dimensional mathematical models is not a problem, making it a good choice for hyperchaotic systems . The anaBesides fully analog and mixed analog-digital realizations of chaotic dynamical systems, there are other possibilities for the experimental verification of the long-term structural stability of a chaotic circuit’s regime. A Field Programmable Analog Array (FPAA) development kit usually offers a graphical user interface and limited-size window where pre-defined building blocks such as ’summators’, filters, and integrators can be easily placed and interconnected. In , both anIt should be pointed out that all of the papers mentioned above contain much more valuable parts than circuit realizations of chaotic systems, namely deep numerical investigations, including bifurcation diagrams, the spectrum of Lyapunov exponents, basins of attraction for individual attractors, etc. Moreover, the provided list of papers dealing with the synthesis of chaotic oscillators is by no means complete. For a further study of the design principles leading to chaos generators, we suggest referring to the comprehensive review work . In addiMem-elements belong to promising circuit components that contain both nonlinearity and internal inertia. Combined with proper additional circuitry, these are good candidates for the generation of robust chaos. Moreover, mem-elements can be included in standard analog computers and broaden their application potential, as suggested in .Many researchers still focus their attention on the problem of finding new chaotic dynamical systems with specific properties or mathematical descriptions of some real physical phenomena. Since circuitry realization and experimental verification are standard components of such scientific papers , the numhttps://www.github.com/mrujzl/Hybrid_computer_v1 (accessed on 27 February 2023) In the following sections, the individual components of the proposed hybrid computer are described in detail.As briefly mentioned earlier, analog computer techniques can be used to model and simulate nonlinear dynamical systems in the continuous time domain. However, purely analog computers cannot process chaotic signals using digital-based algorithms. In this paper, a hybrid computer is introduced to analyze systems exhibiting chaotic solutions in both the continuous and discrete domains. The hybrid computer is composed of classical analog elements, supplemented by ADCs, digital potentiometers, and control circuits. Integrators are the fundamental analog blocks for solving systems described by ordinary differential equations. The introduced hybrid computer consists of four integrator blocks implemented using commercially available monolithic op-amp AD844. When the compensation terminal is utilized, AD844 acts as a second-generation positive current conveyor (CCII+) with a decoupling voltage follower. The advantage of using AD844 is the ease of implementing a switchable sign of the constant of integration, allowing for both positive and negative integrators to be realized. Another advantage of using this element is the grounded capacitor, which facilitates the realization of initial condition settings without the presence of large leakage currents.The change in sign is ensured by a lever switch. Next, a simple rotary switch can be used to change the time constant of the integrator.R and C denote the resistors and capacitors forming the selected time constant, and It is possible to choose from four time constants . The summation blocks are implemented by a standard circuit using the LT1209 operational amplifier, which adds the applied voltages with opposite signs. This opposite sign can be compensated by switching integrators. Consequently, the ’summators’ can be described as:K is the so-called internal division constant  functions and polynomial nonlinearity. To create polynomial nonlinearities, the analog computer has eight  multipliers that operate in all four quadrants. For this purpose, a well-known integrated circuit AD633 with a supply voltage in a range of ±15 Ṽ is employed. Thanks to a simple dividing constant, it allows for easy implementation of the multiplication of two voltages. The formula of the output voltage is:It is not necessary to use analog multipliers only for the realization of nonlinearities. If one of the input voltages is a constant, it is possible to implement a simple multiplication by a constant  in this way.The counting-based potentiometers are connected in the form of voltage dividers, which involves a standard connection method used in analog computers. This topology allows for voltage multiplication by a constant in the range of 0 to 1. The solved tasks are typically normalized to the size of the machine unit, which refers to the voltage value that the solution in the state space should not exceed in any dimension. During normalization, the values of the coefficients of the individual terms of the equations are changed, resulting in values typically in the range of 0 to 1. In the designed analog computer, the size of the machine unit is set to 10 V. In addition to standard analog potentiometers, voltage dividers are also implemented using two digital potentiometers, which can be controlled both with internal control elements and with a computer application.Some basic circuit blocks that allow for the simulation of dynamic systems in several ways are included in the analog part of the presented hybrid computer. These blocks primarily consist of four inverting operational amplifiers with gain one, which realize an ordinary voltage inverter of the connected variable. In addition, there are four non-inverting amplifiers available, including a potentiometer in the feedback loop. Such a configuration of non-inverting operational amplifiers allows for the realization of multiplication operations by a constant (which can be set in a range of 1 to 5) given by the value of the potentiometer. The use of these blocks makes it possible to normalize the simulated system, even to a variable that does not contain the highest value of the parameter. However, this option requires more experience in the derivation of programming schemes.Constant voltage sources are the final analog-based components of the proposed concept. They allow for the setting of the output voltage in the range of the analog component’s supply voltage, which is symmetrically ±15 V. In this design, constant voltage sources are utilized for implementing parameters in the analog multipliers see . Since tApp Designer (https://www.mathworks.com/products/matlab/app-designer.html) (accessed on 27 February 2023) which is available in the MATLAB program environment.The presented hybrid computer, in addition to the previously mentioned digital potentiometers realizing the so-called counting potentiometers, contains other digital components, such as an IC block, PWL block, and ADCs for monitoring the outputs of integrators (state variables). All digital components are controlled by the main processor ATMEGA64 of the hybrid computer, and can be achieved in two ways. By default, the digital parts can be controlled from an integrated keyboard, while information about the current state of each block is displayed on an integrated OLED display. Another option is to provide control by commands via a personal computer. In order to simplify and improve the work with the command-based system, an appropriate desktop application , see As mentioned in A PWL block is implemented to create nonlinearities using a piecewise-linear function. For this purpose, the commercially available AD844 circuit is connected as a voltage amplifier. By changing the polarity of the amplifier, which is realized by a switch, the quadrants in which the PWL function is located are also changed. The resistor connected to the compensation node of the AD844 circuit is implemented as a digital potentiometer, allowing the gain value to be changed in steps. At the input of the amplifier, the AD7322 analog-to-digital converter is used; with its maximum bipolar range of ±10 Ṽ, it covers the range given by the machine unit.The whole PWL block is controlled by a separate ATMEGA8 microprocessor unit (MCU). The MCU contains a lookup table (modifiable by a computer application) that includes the voltage sections and their corresponding gain values. If the processor detects a transition between the voltage sections, determined by the lookup table ADC, it changes the resistance of the digital potentiometer to set the gain to the desired value. Controlling this block via the integrated control units would be complicated, so it is the only block controlled via the created desktop application.recording mode option is selected, allows us to set the sampling rate of the ADC from 1 Hz to 50 kHz. At the beginning of the recording, the recorded data are directly displayed in graphs that show all available variable planes . Next, the data (as recorded attractors) can be saved as images (recorded attractors) or as data files . Thus, the recorded data can be analyzed offline by other tools or algorithms that are generally used for studying chaotic systems .Measured results are often required to be in digital form. For this reason, two AD7322 dual-channel ADCs are employed at the outputs of the integrators , which allow (as in the PWL block) operating in the 10 Ṽ bipolar range of the machine unit. The ADCs are directly connected to the ATMEGA64 MCU via the SPI bus. The recording function used to collect digital results has two modes. The first mode allows direct control via the integrated keyboard, enabling the control processor to read data from the ADCs with the maximum data rate and send the data directly to the serial line to the computer. This mode sends a raw data stream without any regulation, sending the data regardless of whether they are received or not. In the second mode, connection via the desktop application is assumed. The desktop application, when the Obtaining a mathematical description of the problem to be solved;Decomposition of the mathematical description into a set of operations available on the used device;The transformation of variables involving a limited range of used devices, i.e., the range of a machine unit;Time-variable transformation;Creating and wiring programming schema.Various types of calculations and simulations can be performed on analog and hybrid computers. In addition to the already mentioned study of linear and nonlinear dynamical systems, these devices can be used to solve transfer functions, systems of algebraic equations, optimization problems, and find complex roots of polynomials . For thiPoints 1 and 2 are no different from the problem-solving approaches used in standard computers. Point 3 is usually an essential part of the preprocessing of any system on an analog or hybrid computer. Many problems to be solved have a maximum value size that exceeds the size of the machine unit. Therefore, mathematical equations must be modified so that they do not exceed values that the computer cannot handle. The simplest method for this purpose is the normalization method . Therefore, in some cases, it is not technically possible to accelerate the system arbitrarily. There should be values in use that can be expressed and set on the device in use.As visible from , the coePoint 5 is already related to the creation of wiring; it is advisable to redraw the mathematical expression into a graphical form, which is called a programming schema. Examples of a simple programming scheme are given in the following section about example designs.a, b, and c are the parameters of the system and x and its derivative (without the third-order derivative) represent the state variables. For further work, it would be useful to rewrite the equation on the operator form using the Laplace operator p:The use of the presented hybrid computer can be illustrated with a simple chaotic system belonging to the so-called JERK system. These are third-order systems that always contain a polynomial nonlinearity, for which analog multipliers on the hybrid computer can be utilized. System JD0  was chosAs mentioned in , the sysEquation  can be rFrom the point of view of the used hybrid computer, the advantage of this system is the absence of the steps mentioned in points 3 and 4 see , which aThe rewritten equation in a system of differential equations clearly shows the cascading order of integrators, the placement of the ’summator’ at the origin of the system, and the feedback connection. Such a modified equation can be represented graphically as a programming scheme see .Despite the simplicity of the system, it is not necessary to apply points 3 and 4 defined in Equation  can be rThe modified program scheme see  can alreAlgebraically simple third-order chaotic systems suitable for testing can be found in . The proThe hybrid analog computer presented in this paper can be directly used for the synthesis of chaotic circuits based on the Sprott case N, H, and M systems. Therefore, it can serve as a core for a chaos-based sensing system, as described in . AnotherThis paper thoroughly describes the evolution and construction of a hybrid analog computer, which is a universal tool dedicated to the accurate modeling of nonlinear dynamics up to the fourth order. The developed kit contains both analog and digital parts, with the latter used to build complex transfer functions. The digital block is supplemented by ADC and DAC and also allows the user to impose a specific set of initial conditions into the circuit. Therefore, unlike other realizations of analog computers, our functional example is suitable for modeling nonlinear and chaotic systems, where multiple state attractors can coexist, even for discovering the so-called hidden strange attractors, where the basin of attraction is often narrow and lies far away from the state space origin. Although only a simple chaotic system was experimentally verified, the introduced hybrid analog computer is dedicated to modeling much more complicated dynamical systems, including those with symmetrical vector fields, exhibiting hyperchaotic behaviors, demonstrating trigonometric nonlinearities, etc. Because of its versatility, the developed functional example could be a handy tool for circuit-aided modeling. The hybrid analog computer can be used to realize a complete feedback mechanism of advanced controllers. Suitable interconnection can result in an arbitrary signal generator with adjustable frequency, or significantly improve the overall performance of many sensors on the input analog side ,55. From