FedTag: Towards Automated Attack Investigation Using Federated Learning

With the popularity of microservice systems in the industry, the security problems faced by microservice systems have received more and more attention, and the security of their systems is usually reflected in traces, logs, and some monitoring information, which record inter-service interactions and intra-service behaviors, respectively. Existing attack detection methods require a lot of manual intervention to label the data and have a large overhead in constructing the graph. In this paper, we propose a new federated learning-based attack investigation system, FedTag, which consists of three components: data preprocessing, model training, and attack investigation. The data preprocessing package fuses three kinds of log data from different sources, and the model training phase trains the BERT model in the form of joint learning to generate a pre-trained model, which is then fine-tuned to obtain a downstream classifier. In the attack investigation phase, FedTag first flags and embeds detected anomalous log queries then extracts events related to the attack investigation point and labels them as malicious events. Eventually, the attack story can be reconstructed by generating a causal graph or reporting all suspicious events to achieve traceability of attack links. Final experimental results show that FedTag displays TPR and FPR metrics comparable to AirTag when compared to the centralized model. Specifically, for S1–S6 single-host data, federated learning shows less than 1 \(\%\) drop and S2 achieves 100 \(\%\) TNR, outperforming AirTag for M1–M6 multi-host data, federated learning shows only about 1 \(\%\) drop. However, compared to centralized anomaly detection, FedTag not only detects log anomalies but also protects the privacy of each client’s log data.