A system for detecting malware includes a server and processor that executes instructions to receive, from the server, a first malware detection model and a database of known malicious files; label each file of a training data set as either malicious or clean by comparing each file of the training data set to the database, where if a match is not found to in the database, the model is used to predict maliciousness; train the first malware detection model using the labeled training data set; transmit parameters of the trained first malware detection model to the server; and receive, from the server, a second malware detection model, wherein the second malware detection model is trained by federated learning using the parameters of the trained first malware detection model and additional parameters provided by one or more remote devices.