Research code that accompanies the paper Differential Privacy-inspired Federated Split Learning for Anomaly Detection.
DP-FSL is an anomaly detection method that can integrate data information from several edge log collectors in a secure manner.
- While both federated learning and split learning can over privacy solely, we combine both to have one-level more privacy-preserving.
- While most federated learning and split learning are supervised learning, we attend anomaly detection which is not supervised.
- Different from previous methods, we add differential privacy to the aggregated part, instead of directly changing the original data, which can maximize the retention of user-side information.
- We adapt the time series model to split learning which enables our architecture to handle the task of anomaly detection.
| Model | Paper reference |
|---|---|
| DeepLog | [CCS'17] DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning |
| LogAnomaly | [IJCAI'19] LogAnomaly: UnsupervisedDetectionof SequentialandQuantitativeAnomaliesinUnstructuredLogs |
Note: The code of local models is referenced from donglee-afar/logdeep.
| Algorithm | Paper reference |
|---|---|
| Fedavg | [PMLR'20] Communication-Efficient Learning of Deep Networks from Decentralized Data |
| FedAdam | [ICLR'21] Adaptive Federated Optimization |
| DeepLog | LogAnomaly | ||||||
|---|---|---|---|---|---|---|---|
| F1 | Precision | Recall | F1 | Precision | Recall | ||
| Single Set | 92.288 | 88.432 | 96.495 | 93.453 | 91.171 | 96.911 | |
| Whole Set | 95.334 | 93.159 | 97.613 | 94.438 | 96.325 | 96.624 | |
| FedAdam | 94.303 | 94.630 | 93.978 | 94.111 | 94.879 | 93.356 | |
| SL+FedAdam | 92.868 | 86.905 | 99.163 | 93.913 | 94.095 | 93.568 | |
| DP-FSL (ours) | 92.630 | 91.654 | 94.115 | 93.624 | 93.030 | 96.328 |