Federated Machine Learning for Privacy-Preserving Cyberattack Detection Across Distributed Edge and Telecommunications Network Environments

Abstract

Next-generation telecommunications are shifting cyberattack detection from centralized security operations toward geographically dispersed 5G/6G radio access networks, multi-access edge computing nodes, virtualized network functions, and subscriber-facing IoT gateways. This distribution creates a critical detection problem: attack evidence is fragmented across administrative and geographic domains, while centralizing packet flows, authentication traces, signaling records, and device telemetry can expose sensitive subscriber information. This study develops a hierarchical federated machine-learning framework for privacy-preserving detection of coordinated attacks across heterogeneous telecommunications edge environments. Local models learn behavioral and traffic representations from network-specific data, while hierarchical aggregation combines edge-level intelligence without transferring raw records. The framework incorporates client selection, privacy-preserving model updates, adaptive aggregation for non-IID traffic, and poisoning-resistant update validation. Its effectiveness is examined against DDoS, botnet, signaling abuse, credential compromise, and lateral-movement scenarios using detection recall, F1-score, false-positive rate, convergence time, communication cost, privacy leakage, and resilience under malicious-client participation. Comparative evaluation against centralized, isolated-edge, and conventional federated baselines determines whether collaborative learning improves cross-domain attack recognition without sacrificing telecommunications latency and data sovereignty. The resulting framework provides a scalable security architecture for converting distributed network observations into shared cyber-threat intelligence while retaining operational control and subscriber-data locality.