Multi-agent system implementing federated learning for cybersecurity applications

A method for implementing coordinated cybersecurity threat detection across a distributed system, the method comprising:

• receiving, from each node of multiple nodes of the distributed system, a plurality of parameters representative of model updates to a corresponding machine-learning model that is trained at the corresponding node of the distributed system, wherein:
• the corresponding machine learning model is trained to detect cybersecurity threats within a context of the corresponding node based on local data received by the corresponding node;
• and
• the model updates are learned from the local data,
• generating, based on the parameters received from the multiple nodes, a set of global model parameters that represents global updates to the individual machine-learning models trained at the multiple nodes of the distributed system;
• and
• transmitting to each node of at least a subset of the multiple nodes of the distributed system, a respective selected subset of the global model parameters, wherein:
• the global model parameters of the respective selected subset are configured to update local model parameters of the corresponding machine learning model at the node;
• the size of the respective selected subset is smaller than the size of all global model parameters;
• and
• the respective selected subset is identified based on a potential cybersecurity threat context of the corresponding node.

One or more non-transitory computer-readable storage media encoded with computer program instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:

• receiving, from each node of multiple nodes of the distributed system, a plurality of parameters representative of model updates to a corresponding machine-learning model that is trained at the corresponding node of the distributed system, wherein:
• the corresponding machine learning model is trained to detect cybersecurity threats within a context of the corresponding node based on local data received by the corresponding node;
• and
• the model updates are learned from the local data,
• generating, based on the parameters received from the multiple nodes, a set of global model parameters that represents global updates to the individual machine-learning models trained at the multiple nodes of the distributed system;
• and
• transmitting to each node of at least a subset of the multiple nodes of the distributed system, a respective selected subset of the global model parameters, wherein:
• the global model parameters of the respective selected subset are configured to update local model parameters of the corresponding machine learning model at the node;
• the size of the respective selected subset is smaller than the size of all global model parameters;
• and
• the respective selected subset is identified based on a potential cybersecurity threat context of the corresponding node.