Federated Threat Intelligence with Privacy-Preserving Anomaly Fusion

Abstract

This paper proposes a Federated Threat Intelligence (FTI) framework that enables organisations to collaboratively detect emerging cyber threats without exposing sensitive logs, user data, or proprietary indicators. We introduce privacy-preserving anomaly fusion, a method that aggregates local anomaly evidence across distributed participants using federated learning and secure aggregation, reducing the risk of data leakage while strengthening global detection capability. The approach combines (i) local anomaly detectors tailored to each organisation’s environment, (ii) robust cross-site fusion to mitigate noisy or adversarial updates, and (iii) lightweight privacy mechanisms such as differential privacy and encrypted model update exchange. We evaluate the framework on heterogeneous network and endpoint telemetry scenarios, demonstrating improved detection of low-frequency, previously unseen attack patterns compared to isolated models and conventional centralised sharing. Results indicate that anomaly fusion achieves higher recall under domain shifts while maintaining operationally acceptable overhead and formal privacy guarantees. The proposed FTI architecture supports scalable, trust-aware collaboration among enterprises, critical infrastructure, and public-sector partners, offering a practical path toward collective defence in increasingly fragmented and regulated data environments.