Federated Cyber Defense: Privacy-Preserving Ransomware Detection Across Distributed Systems

TL;DR

This paper demonstrates that federated learning can effectively train ransomware detection models across multiple organizations, enhancing accuracy while preserving data privacy and complying with regulatory constraints.

Contribution

It evaluates federated learning for ransomware detection, showing it achieves comparable performance to centralized models without data sharing, addressing privacy and legal challenges.

Findings

Federated learning improves detection accuracy by 9% over local models.

Performance of federated models is comparable to centralized training.

The approach is scalable and privacy-preserving for cybersecurity applications.

Abstract

Detecting malware, especially ransomware, is essential to securing today's interconnected ecosystems, including cloud storage, enterprise file-sharing, and database services. Training high-performing artificial intelligence (AI) detectors requires diverse datasets, which are often distributed across multiple organizations, making centralization necessary. However, centralized learning is often impractical due to security, privacy regulations, data ownership issues, and legal barriers to cross-organizational sharing. Compounding this challenge, ransomware evolves rapidly, demanding models that are both robust and adaptable. In this paper, we evaluate Federated Learning (FL) using the Sherpa.ai FL platform, which enables multiple organizations to collaboratively train a ransomware detection model while keeping raw data local and secure. This paradigm is particularly relevant for cybersecurity companies (including both software and hardware vendors) that deploy ransomware detection or firewall systems across millions of endpoints. In such environments, data cannot be transferred outside the customer's device due to strict security, privacy, or regulatory constraints. Although FL applies broadly to malware threats, we validate the approach using the Ransomware Storage Access Patterns (RanSAP) dataset. Our experiments demonstrate that FL improves ransomware detection accuracy by a relative 9% over server-local models and achieves performance comparable to centralized training. These results indicate that FL offers a scalable, high-performing, and privacy-preserving framework for proactive ransomware detection across organizational and regulatory boundaries.