Zero-Knowledge Federated Learning for Privacy-Preserving Cyber Threat Detection

Abstract

The growing nature and complexity of the cyber threats within the distributed digital infrastructures require collective intelligence without jeopardizing the privacy of data. Federated Learning (FL) is an up-and-coming model that holds potential in training models in a decentralized way; nonetheless, the existing FL models are susceptible to information leakage as a result of model updates and adversarial inference attacks. To overcome these shortcomings, this paper introduces a Zero-Knowledge Federated Learning (ZK-FL) system to detect cyber threats in a privacy-preserving way so that collaboration in the learning process can be secured without sensitive information about the intermediate models and without exposing sensitive data. In the suggested solution, the zero-knowledge proof (ZKP) mechanisms along with federated optimization are combined to make sure that the participating clients can prove the accuracy of their local model updates, revealing no data features. This cryptographic integrity check deters malicious model poisoning, gradient inversion and unauthorized inference of data, improving the confidence of heterogeneous and untrusted parties. Another approach used is a secure aggregation protocol which protects model parameters in the transmission process to guarantee end-to-end confidentiality and integrity. The framework is tested with actual datasets of cyber threat in a distributed environment and adversarial environment. Empirical studies show that the suggested ZK-FL model can be used to obtain a high detection accuracy and robustness on par with centralized learning, and substantially increase privacy guarantees and anti-inference attack. Furthermore, the communication and computation cost that is entailed by zero-knowledge verification is within manageable limits, and thus the solution is feasible to large-scale cyber defence systems. The suggested ZK-FL architecture provides a secure and trusted platform to cooperative cyber threat intelligence, which is a scalable service in privacy-sensitive environments like enterprise networks, critical infrastructures, and edge-cloud security systems.