Privacy-Preserving Federated Learning for Phishing Detection

Abstract

Machine learning is one of the most prominent technologies used to combat phishing detection; however, the vast amount of data required for training models for detection raises a privacy concern for end users. Gathering email or document data may very well contain private information, and the machine learning models learn from the words and other attributes of these text-based documents. Gathering this information in a centralized location and using it to train models could pose a security risk on all levels of data acquisition, from the transfer of the data to the storage. Federated learning is emerging as a promising alternative to traditionally centralized machine learning for phishing detection. The advantages of federated learning, mainly in privacy and scalability, are weighed against the issue of detection accuracy. Federated learning provides the ability to train models without the transfer of sensitive data, more or less no raw data from the device, and allows the training to be done locally; this eliminates the privacy exposure accompanied by traditional machine learning models that operate in a centralized manner. However, this alone is not enough to comply with privacy regulations, such as General Data Protection Regulation (GDPR) and the European Union (EU) Artificial Intelligence Act (AI Act), and privacy-preserving technology must be used in conjunction to ensure federated learning’s compliance with privacy regulations. This article is a dedication to Professor Thomas Chen’s aspirations in the field of cybersecurity. This article is dedicated to his memory.