Federated Learning and Zero‐Trust Architecture for Privacy Preservation and Collaborative Threat Intelligence

Collaborative cyber threat intelligence systems require secure information sharing across distributed organizations while preserving data privacy and preventing unauthorized access. However, conventional centralized cybersecurity architectures introduce significant privacy risks, limited trust management, and increased vulnerability to data leakage and adversarial manipulation. Although federated learning (FL) enables decentralized collaborative model training without direct data sharing, federated environments remain vulnerable to poisoning attacks, inference attacks, unauthorized participation, and heterogeneous non‐IID data distributions. This paper proposes an integrated federated learning and zero‐trust architecture (FL–ZTA) framework for privacy‐preserving collaborative cyber threat intelligence sharing. The proposed framework combines decentralized federated learning, continuous zero‐trust verification, trust‐aware aggregation, adaptive policy enforcement, and secure collaborative coordination mechanisms to improve both privacy preservation and distributed cybersecurity resilience. The proposed framework was evaluated using the CIC‐IDS2017 cybersecurity dataset under both IID and non‐IID federated environments. Experimental analysis compared FedAvg, FedProx, and differentially private federated averaging (DP‐FedAvg) within the proposed FL–ZTA architecture. The results demonstrate improved resilience against poisoning and inference‐based attacks while maintaining stable collaborative learning performance under heterogeneous federated conditions. Furthermore, the proposed framework improves secure organizational collaboration by integrating continuous trust verification and adaptive federated coordination without requiring centralized raw data sharing. The findings demonstrate the potential of FL–ZTA architectures for privacy‐preserving collaborative cybersecurity systems operating across distributed and security‐sensitive infrastructures.