A federated framework for simulating and predicting malware propagation in network topologies with privacy awareness

In the digital era, security threats from self-propagating malware present a critical challenge for network infrastructure. Although classical epidemiological models are valuable for analyzing malware, their deterministic nature, along with administrative barriers to consolidating raw network data, hinder accurate distributed forecasting. In this study, a novel federated learning framework is presented for predicting malware spread in complex networks which, while maintaining data locality, exploits deep spatio-temporal models. To reconstruct spread dynamics, the Gillespie stochastic simulation algorithm was used to implement five epidemiological models (SIS, SIR, SIRS, SEIR, and SEIRS) on Watts–Strogatz and Barabási–Albert network topologies as well as a real-world Twitter network subgraph. The proposed spatio-temporal attention network (STAN) architecture combines multi-head attention and LSTM units to extract spatial and temporal nonlinear correlations. Experimental results across multiple random seeds showed that STAN performed favorably compared to basic LSTM, achieving high overall accuracy, F1-Score, and Matthews Correlation Coefficient (MCC) tracking profiles. Crucially, STAN demonstrated high resilience against persistence baseline constraints on irregular structures where standard sequential models experienced degradation. Also, the implementation in a decentralized framework using a module-based partitioning strategy showed that the global model closely tracks centralized training trends and exhibits robust generalization due to a regularizing effect during weight aggregation. This research suggests that combining spatio-temporal artificial intelligence with distributed learning provides a data-local, scalable, and accurate solution for monitoring simulated cyber threats under localized data constraints.