FATE-X: a federated transferable and explainable deep learning framework for APT detection in serverless edge environments
摘要
Advanced Persistent Threats (APTs) pose substantial risks to Serverless edge computing environments due to their stealthy, adaptive, and distributed nature. Traditional centralized detection schemes often struggle with privacy constraints, communication overhead (CO), and delayed response. To overcome these challenges, this paper introduces FATE-X, a Federated, Transferable, and Explainable deep learning framework specifically designed for APT detection in Serverless edge environments. FATE-X integrates federated learning (FL) and transfer learning to enhance cross-node adaptability and maintain data privacy through local model training and secure aggregation. Furthermore, a SHAP-based explainability module is embedded into the inference pipeline, allowing real-time, interpretable detection decisions at each edge node with minimal computational cost. Experimental evaluations conducted on four CIC-APT2023, APTEdge2024, NSL-KDD, and StreamSpot datasets demonstrate the superior performance of FATE-X compared to state-of-the-art methods such as ReAPT-AttP, GraphBDL, and CONTINUUM. The framework achieves up to 4.8% higher accuracy and F1-score, notably reduces the False Positive Rate (FPR), and lowers CO while ensuring explainability and scalability. For example, FATE-X attains 96.8% accuracy on CIC-APT2023 and 99.93% on APTEdge2024, confirming its robustness across heterogeneous and realistic edge environments. The source codes and experimental setup of FATE-X Serverless are accessible at https://github.com/behnam1368/FATE-X-Serverless.