Privacy-Preserving Threat Intelligence Sharing Across Distributed Cloud Enterprise Systems Using Federated Learning

Abstract

Distributed cloud enterprise systems generate extensive cybersecurity data across heterogeneous infrastructures, including network traffic, application logs, identity services, and endpoint monitoring platforms. Sharing threat intelligence across organizations can improve attack detection and accelerate incident response; however, transferring sensitive security data introduces privacy, confidentiality, regulatory, and organizational challenges. This research proposes a privacy-preserving threat intelligence sharing framework based on federated learning for distributed cloud enterprise environments. The framework enables participating organizations to collaboratively train machine learning models while retaining raw security data within their respective infrastructures. Local models analyze security events and identify malicious patterns, while model updates are aggregated through a coordinated federated learning process. Differential privacy, secure aggregation, encrypted communication, and participant authentication are incorporated to reduce the risks of sensitive information disclosure and unauthorized model manipulation. The proposed methodology evaluates threat detection performance, privacy protection, communication overhead, model convergence, and scalability under heterogeneous cloud conditions. Experimental comparisons between centralized learning, independent local learning, and federated learning establish a basis for assessing collaborative intelligence benefits. Additional investigations examine non-independent data distributions, malicious participants, poisoning attacks, and changing threat patterns. The framework aims to strengthen collaborative cyber defense without requiring direct exchange of raw enterprise security records. By combining distributed machine learning with privacy-aware coordination and security governance, this research provides a foundation for scalable, trustworthy, and privacy-preserving threat intelligence sharing across interconnected cloud enterprise systems.