Federated Learning Privacy Protection Collaboration Model Based on Improved Cyber Threat Collaborative Analysis Capability

Abstract

Traditional federated learning has challenges such as slow model convergence, lagging situational awareness, and risk of gradient privacy leakage in cyber threat collaborative analysis capability. This study proposes a federated learning privacy-preserving collaboration model based on threat intelligence drive and hierarchical aggregation. The model optimizes participating nodes through a dynamic client selection mechanism, uses a hierarchical aggregation strategy to balance the learning of basic features and advanced threat patterns, and introduces an adaptive differential privacy mechanism to strengthen gradient protection. The experiment is based on the CIC-IDS-2018 public dataset, which covers various types of attacks in real network environments, with a data volume of approximately 5 million pieces. It is divided into 50 clients in a non-independent and identically distributed manner to simulate cross organizational collaboration scenarios. In the threat detection task, the model designed by the research institute achieved an accuracy of 91.8% and an F1 Score of 89.8% compared to baseline models such as FedAvg, FedProx, and DP FedAvg. All indicators were superior to the comparison model. In addition, in the advanced persistent threat attack scenario, the attack chain detection rate increased to 95.6%, and the average detection time was shortened to 2.8 hours. In terms of privacy protection, the Rényi privacy loss was only 2.89 with a budget of ε=3.0. The proposed model effectively improves the efficiency and timeliness of collaborative detection of cross-organizational threats while ensuring data privacy and provides a feasible solution for building a safe and reliable collaborative defense system. It should be pointed out that while improving detection performance, the model introduces additional communication overhead caused by hierarchical aggregation and dynamic selection mechanisms. The average communication traffic in the experiment was about 13.8 GB. As the number of clients expands to a larger scale, the computational load and scheduling complexity of the coordination layer will further increase. In addition, although the non-independent and identically distributed data partitioning used in the experiment can simulate real heterogeneous scenarios, the convergence efficiency of the model under extreme distributions still needs further verification. The above limitations will be optimized in future work by introducing asynchronous aggregation and lightweight communication protocols.