Federated Learning Paradigms for Privacy-Preserving Multi Organizational Threat Intelligence Sharing

Cyber threat intelligence sharing is widely recognized as a strategic component for improving early detection of malicious campaigns, correlation of indicators of compromise, and coordinated incident response. Despite this potential, direct exchange of operational data among institutions remains constrained by regulatory, contractual, competitive, and technical barriers, especially when network telemetry, authentication logs, endpoint events, and sensitive artifacts are involved. In this context, federated learning has been investigated as an approach capable of enabling collaborative training without centralizing raw data. This article discusses the main federated learning paradigms applied to multi-organizational cyber threat intelligence sharing, with emphasis on privacy preservation, robustness against adversarial manipulation, statistical heterogeneity across participants, and scalability limitations. It also examines complementary techniques such as secure aggregation, differential privacy, homomorphic encryption, secure multi-party computation, and Byzantine-robust mechanisms. Recent literature suggests that federated learning can improve the generalization capability of detection models when compared with strictly local approaches, although its practical adoption still depends on more mature solutions for inter-organizational trust, semantic interoperability, and technical governance.