The role of anomaly detection systems in Critical Infrastructures (CIs) is critical due to the complexity of CIs and their control systems, which are usually implemented by computer-based controllers that constantly produce logs of their activities. Moreover, many CIs, located in different locations or even belonging to different companies, may share similar application software for controlling the CIs themselves. The goal of this work is to use such logs to perform automatic anomaly detection in a federated learning (FL) paradigm, which ensures that no data is exchanged between sites to train the anomaly detection models, but each learning agent learns on its own data, leveraging the knowledge acquired by the other agents. Our proposed approach - AdaLightLog - which implements a modified FL paradigm with adaptive loss functions at local servers side and weighted averaging of local server models, so to differentiate the quality of the different local servers’ models in the global averaging, is tested against state-of-the-art methods and shows an improvement in performance in terms of accuracy, precision and recall with respect to the standard FL implementation (FedAvg). Furthermore, a comparison between different metrics for the adaptive loss functions and the dynamic weights is presented.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

AdaLightLog: Enhancing Application Logs Anomaly Detection via Adaptive Federating Learning

  • Danilo Menegatti,
  • Emanuele De Santis,
  • Stefano Felli,
  • Alessandro Giuseppi

摘要

The role of anomaly detection systems in Critical Infrastructures (CIs) is critical due to the complexity of CIs and their control systems, which are usually implemented by computer-based controllers that constantly produce logs of their activities. Moreover, many CIs, located in different locations or even belonging to different companies, may share similar application software for controlling the CIs themselves. The goal of this work is to use such logs to perform automatic anomaly detection in a federated learning (FL) paradigm, which ensures that no data is exchanged between sites to train the anomaly detection models, but each learning agent learns on its own data, leveraging the knowledge acquired by the other agents. Our proposed approach - AdaLightLog - which implements a modified FL paradigm with adaptive loss functions at local servers side and weighted averaging of local server models, so to differentiate the quality of the different local servers’ models in the global averaging, is tested against state-of-the-art methods and shows an improvement in performance in terms of accuracy, precision and recall with respect to the standard FL implementation (FedAvg). Furthermore, a comparison between different metrics for the adaptive loss functions and the dynamic weights is presented.