arXiv:2506.19246cs.LG2025-06被引 13

用联邦对比学习实现分布式系统异常检测,保护隐私还更准。

Behavioral Anomaly Detection in Distributed Systems via Federated Contrastive Learning

  • 在本地节点构建行为嵌入,通过对比学习增强特征区分性。
  • 在多种攻击类型下准确率超现有方法,实时流场景响应快。
  • 适合关注隐私安全的云原生、大规模分布式系统运维者。

本文针对分布式系统中日益突出的异常检测问题,提出一种基于联邦对比学习的检测方法。该方法克服传统集中式方案在数据隐私、节点异构性和异常模式识别方面的局限。通过结合联邦学习的分布式协同建模能力与对比学习的特征区分增强机制,在本地节点构建行为数据的嵌入表示,包括系统日志、运行指标和系统调用,并构造正负样本对以引导模型学习更具判别性的特征空间。无需暴露原始数据,通过联邦聚合策略优化全局模型。采用编码器将本地行为数据映射至高维空间,同时使用对比损失和分类损失联合训练,提升对细粒度异常模式的检测能力。在多种典型攻击类型下进行评估,并在模拟实时数据流场景中测试其响应性能。实验结果表明,该方法在多个性能指标上优于现有方法,展现出高检测精度与强适应性,有效应对分布式环境中的复杂异常。通过关键模块的精心设计与训练机制优化,实现了隐私保护与检测性能的平衡,为分布式系统的智能安全管理提供了可行技术路径。

原文摘要 · Abstract (English)

This paper addresses the increasingly prominent problem of anomaly detection in distributed systems. It proposes a detection method based on federated contrastive learning. The goal is to overcome the limitations of traditional centralized approaches in terms of data privacy, node heterogeneity, and anomaly pattern recognition. The proposed method combines the distributed collaborative modeling capabilities of federated learning with the feature discrimination enhancement of contrastive learning. It builds embedding representations on local nodes and constructs positive and negative sample pairs to guide the model in learning a more discriminative feature space. Without exposing raw data, the method optimizes a global model through a federated aggregation strategy. Specifically, the method uses an encoder to represent local behavior data in high-dimensional space. This includes system logs, operational metrics, and system calls. The model is trained using both contrastive loss and classification loss to improve its ability to detect fine-grained anomaly patterns. The method is evaluated under multiple typical attack types. It is also tested in a simulated real-time data stream scenario to examine its responsiveness. Experimental results show that the proposed method outperforms existing approaches across multiple performance metrics. It demonstrates strong detection accuracy and adaptability, effectively addressing complex anomalies in distributed environments. Through careful design of key modules and optimization of the training mechanism, the proposed method achieves a balance between privacy preservation and detection performance. It offers a feasible technical path for intelligent security management in distributed systems.

异常检测联邦学习对比学习分布式系统

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。