Malware detection using federated learning

A malware detection system comprising:

• one or more processors;
• and
• memory having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, from a remote device, a first malware detection model and a database of known malicious files;
• labeling each file of a training data set as either malicious or clean by comparing each file of the training data set to the database, wherein:
• if a file of the training data set matches a known malicious file in the database, the file is labeled as malicious;
• and
• if a match is not identified for a file of the training data set, the file is evaluated using the first malware detection model to predict whether the file is malicious and the file is labeled based on the prediction;
• training the first malware detection model using the labeled training data set;
• transmitting parameters of the trained first malware detection model to the remote device;
• and
• receiving, from the remote device, a second malware detection model, wherein the second malware detection model is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more additional remote devices.