ATLAS: an adaptive threat learning and analysis system using heterogeneous federated deep learning and FedNova aggregation for multi-cloud environments

Abstract

The proliferation of multi-cloud architectures has intensified challenges in phishing detection, as security intelligence becomes fragmented across heterogeneous cloud infrastructures governed by stringent privacy regulations and data sovereignty constraints. Conventional centralized threat detection paradigms necessitate aggregating sensitive data from disparate sources, thereby introducing substantial privacy risks, regulatory compliance burdens, and communication bottlenecks. This paper introduces ATLAS (Adaptive Threat Learning and Analysis System), a privacy preserving threat intelligence framework leveraging Heterogeneous Federated Deep Learning (HFDL) for collaborative multi-cloud cybersecurity. Unlike traditional federated learning approaches that presuppose uniform model architectures across participants, ATLAS accommodates diverse client models specifically, a Convolutional Neural Network (CNN), Bidirectional Gated Recurrent Unit (BiGRU), and XGBoost classifier each trained on disjoint feature subsets representing distributed cloud observations. To reconcile objective inconsistencies and heterogeneous local training dynamics, ATLAS evaluates multiple aggregation strategies: FedAvg (naive probability averaging), FedProx (performance weighted aggregation), FedNova (normalized averaging accounting for local update heterogeneity), and a meta-learning ensemble. Comprehensive experiments on the PhishNet phishing detection dataset reveal that ATLAS with FedNova aggregation attains 95.21% accuracy and 95.19% F1-score, surpassing FedAvg (94.57% accuracy) with statistical significance confirmed via McNemar’s test ( \(\chi ^2=4.97\) , \(p=0.026\) ). Performance approaches that of centralized learning (96.79% accuracy) while achieving approximately 80.6% reduction in communication overhead and negligible aggregation latency (0.00025 ms/sample), thereby enabling real-time deployment. These findings establish heterogeneous federated learning as a viable, scalable, and privacy preserving paradigm for collaborative threat detection in distributed multi-cloud environments, effectively balancing detection efficacy with data sovereignty requirements.