PaperlayerView exact revision on arXiv

Source-linked AI summary

Federated Attack Campaign Detection via Contrastive Encoding of Threat Indicators in Gradient Updates

Manuel Röder, Bibin Babu, Frank-Michael Schleif

arXiv:2609.04815v1cs.LGcs.CR

TL;DR

Cross-organizational attack campaigns are difficult to detect because defenders hold partial indicator views and cannot freely share sensitive telemetry or threat intelligence. FedIoC encodes local IoC knowledge into federated gradients through supervised contrastive training, then clusters client updates by cosine similarity to recover campaign cohorts without raw IoC transmission. Across the evaluated benchmarks, campaign recovery is observed from gradient geometry, while the controlled study identifies non-IID gradient structure as the main driver and leaves more effective encoders as an open problem.

  • Problem

    Campaign detection lacks a way to combine organizations’ partial IoC views without sharing sensitive telemetry or threat intelligence, while existing FL systems discard richer IoC metadata beyond class labels.

  • Method

    FedIoC adds an indicator-weighted supervised contrastive loss over IoC-matched flows and clusters individual client gradients by cosine similarity to recover campaign cohorts without transmitting raw indicators.

  • Results

    Across CTU-13, the server recovered campaign cohorts from gradient geometry, with Peak ARI 0.89–0.97 and Mean ARI 0.76–0.86 across contrastive variants and FedAvg.

  • Takeaways & Limitations

    Campaign cohorts can be recovered directly from uploaded gradient geometry, but the benchmark evidence indicates recovery is largely driven by non-IID gradient structure rather than uniquely by the indicator-specific objective.

  • Takeaways & Limitations

    Effective clustering requires the server to observe individual client updates, which is incompatible with secure aggregation and creates a privacy–utility trade-off.

Abstract

from arXiv · show

Detecting orchestrated cyberattack campaigns that span multiple organizations traditionally requires sharing sensitive telemetry and threat intelligence across institutional boundaries and country borders, a barrier that Federated Learning removes by training shared threat detectors directly on local data. We propose FedIoC, a modular framework in which clients fold locally available structured threat indicators into their gradient updates; we instantiate the client-side encoder with a supervised contrastive loss over IoC-matched flows. Within each training batch, flows that match any known indicator pattern form the positive set; the contrastive objective pulls their learned embeddings together and pushes non-IoC embeddings away, so that campaign-relevant structure is, by design, expressed in the gradient direction. Clients sharing indicators for the same attack campaign then produce aligned gradient components, which the server clusters by the cosine similarity of their updates to recover global campaign patterns without any direct IoC transmission. We evaluate FedIoC on two public threat-detection benchmarks distributed across FL clients that each observe only a fragment of every active campaign and hold disjoint indicator sets derived from their local telemetry. In this regime the FL server recovers cross-organizational campaign cohorts directly from gradient geometry. We contribute FedIoC as a modular framework for this setting, and use it to pinpoint the non-IID gradient structure as the main driver of recovery and to define the open problem of designing encoders that improve on it.

1 Introduction

FedIoC addresses fragmented cross-organizational campaign detection by encoding local threat indicators into federated gradients, allowing the server to recover campaign cohorts without transmitting raw indicators. The framework combines indicator-aware contrastive client training with cosine-based server clustering, while treating the specific encoder as an open research problem.

  • Motivation: Organizations observe only partial campaign indicators, while sharing raw telemetry or intelligence is constrained by reluctance, sovereignty requirements, and indicator staleness.Existing federated systems reduce IoCs to class labels, discarding richer metadata and campaign-cohort signal.
  • FedIoC framework: FedIoC adds a supervised contrastive loss over indicator-matched flows so local threat indicators influence client gradient updates.The evaluated encoder uses an indicator-weighted contrastive objective alongside local training.
  • FedIoC framework: The server clusters individual client gradients by cosine similarity to recover campaign cohorts without receiving raw indicators.The framework reports cohorts of clients sharing exposure to the same attack infrastructure before standard aggregation and broadcast.
  • Contributions: The framework is modular: the client-side gradient encoder is interchangeable, and the evaluated contrastive encoder is presented as one instantiation.Alternative encoders remain open for future work.

2 Methodology

FedIoC encodes locally available indicators into client updates through a two-pass contrastive objective, then clusters client gradients by cosine similarity to recover campaign cohorts without transmitting raw indicators.

  • Client-side IoC encoding: FedIoC identifies locally matched flows using indicator predicates and confidence scores, then uses those matches to encode client-local threat intelligence.Any client-evaluable matching rule is admissible; STIX observables provide predicates and confidence weights.
  • Client-side IoC encoding: The IoC loss applies supervised contrastive learning to matched anchors, treating other matched flows as positives and non-IoC flows as negatives.Embeddings are ℓ2-normalized, and indicator confidence supplies the per-anchor weight.
  • Two-pass client update: FedIoC transmits an additive update combining a cross-entropy task component with an independently computed IoC-contrastive component.The two-pass construction adds one local epoch while leaving communication unchanged because only the summed update is transmitted.
  • Server-side campaign detection: The server computes pairwise cosine similarities among non-zero client updates and applies complete-linkage agglomerative clustering to derive campaign cohorts.The distance is D_ij = 1 − S_ij, and complete linkage limits chain-collapse under heterogeneous gradient norms.
  • Compatibility and assumptions: The framework assumes synchronous full-client participation experimentally, while allowing clustering and aggregation over reporting subsets under partial participation.The algorithm specifies global initialization, local epochs, contrastive parameters, a distance threshold, and repeated client-update transmission.
  • Compatibility and assumptions: FedIoC requires individual client updates, so it is compatible with FedAvg, FedProx, and SCAFFOLD but not secure aggregation or split/vertical FL.Strongly homogenizing inter-client directions can suppress the gradient diversity that clustering exploits.

3 Experimental Setup

The experiments partition CTU-13 and UNSW-NB15 into campaign-stratified non-IID clients with partial campaign views, then compare local-only, standard FL, drift-control, and IoC-contrastive methods using campaign-recovery and detection metrics.

  • Datasets: CTU-13 contains 13 botnet campaigns, while UNSW-NB15 contains nine heterogeneous attack families treated as campaigns.CTU-13 provides structured campaign labels; UNSW-NB15 broadens evaluation across diverse attack families.
  • Data partitioning: Ten clients receive campaign-stratified non-IID partitions, each observing 3–5 campaigns but never a complete view of any campaign.Each scenario is split into three equal chunks assigned round-robin, with local STIX indicators covering only observed campaign fragments.
  • Baselines: The study compares local-only training, FedAvg, FedProx, SCAFFOLD, IoC plugins, a label-only contrastive control, and FedIoC.FedIoC uses IoC-contrastive gradients over a FedAvg base; FedProx and SCAFFOLD test compatibility with other aggregation strategies.
  • Visualization: Figure 2 visualizes server campaign cohorts from per-client gradients under FedAvg and FedIoC on CTU-13.Clients are colored by dominant ground-truth campaign, while edge opacity represents cosine similarity.
  • Metrics: Campaign recovery uses ARI and NMI, including peak and early-window mean ARI, while macro-F1 measures held-out detection performance.The secondary classification metric checks whether IoC encoding preserves intrusion-detection capability.

4 Preliminary Results and Discussion

Across CTU-13 and UNSW-NB15, gradient geometry recovers campaign cohorts, but FedIoC does not yet show an indicator-specific advantage over FedAvg or label-only contrastive learning. IoC encoding leaves classification performance approximately unchanged.

  • Campaign recovery: Peak ARI reaches 0.89–0.97 and mean ARI reaches 0.76–0.86 across CTU-13 methods, showing strong campaign-cohort recovery.FedIoC records Peak 0.97 and Mean 0.85, within variation of FedAvg+SupCon-lbl and FedAvg.
  • Campaign recovery: On CTU-13, FedIoC is statistically comparable to label-only contrastive learning and plain FedAvg, while FedAvg or FedProx matches or exceeds it on UNSW-NB15.The indicator-weighted objective does not yield a separable gain under these benchmark conditions.
  • Interpretation: Gradient clusters correspond to clients with campaign-correlated traffic distributions, allowing cohort reports without disclosing specific indicators.Campaign-discriminative gradients are strongest early, then weaken as the shared model converges and client gradients become more homogeneous.
  • Classification performance: FedIoC macro-F1 remains within noise of FedAvg on CTU-13 at 0.50 versus 0.49 and on UNSW-NB15 at 0.45 versus 0.48.The label-only control also matches this approximate non-interference, while absolute F1 remains modest across non-degenerate methods.

5 Related Work

Prior work uses IoCs mainly as labels, suppresses non-IID gradient divergence, or applies contrastive learning within individual models. FedIoC instead treats gradient divergence as a campaign signal for cross-client recovery.

  • Federated threat detection: Existing federated threat-detection systems reduce IoCs to per-flow labels, discarding richer metadata and campaign-cohort information before aggregation.The omitted metadata includes confidence, temporal validity, and kill-chain context.
  • FL heterogeneity: FedAvg, FedProx, and SCAFFOLD generally treat inter-client gradient divergence as instability to suppress, whereas FedIoC clusters that divergence as campaign signal.The contrastive term composes acceptably with FedProx but interacts poorly with SCAFFOLD in the reported regime.
  • Contrastive learning: Supervised contrastive learning traditionally aligns same-class embeddings within one model, while FedIoC uses indicator matches to align gradient signals across clients.This reverses the usual focus from representation alignment inside a model to server-readable campaign structure.
  • Research gap: The identified research gap is encoding threat-indicator structure into client gradients so servers can recover campaigns without raw indicator transmission.FedIoC is presented as an initial framework addressing this cross-organizational attribution problem.

6 Conclusion

FedIoC provides a modular framework for recovering campaign cohorts by cosine-clustering federated gradients without transmitting raw indicators. The study finds that recovery is largely driven by non-IID gradient structure and leaves more effective gradient encoders as the central open problem.

  • Conclusion: FedIoC gives a partial affirmative answer: cosine clustering of uploaded gradients detects campaign cohorts without raw indicator transmission.The framework is intended as infrastructure for gradient-space campaign attribution across organizations.
  • Conclusion: The observed recovery arises largely from non-IID gradient structure because the indicator-weighted objective is not separable from a label-only control on the benchmark dataset.The authors therefore identify more effective gradient-encoding methods as the highest-priority future direction.

A Implementation Details

FedIoC uses a three-hidden-layer MLP trained with fixed optimization settings, while deliberately limiting local training to one epoch to preserve client-gradient cosine structure. Its seven-round campaign-recovery window and contrastive scaling depend on operational and data-dependent considerations.

  • Model and optimization: The global model is a three-hidden-layer MLP with ReLU activations and dropout 0.3, using five flow-level features.Training uses Adam with learning rate 1 × 10^-4, batch size 256, and E = 1 local epoch per round.
  • Model and optimization: E = 1 local epoch is deliberate because additional local epochs homogenize client gradients and collapse their cosine-similarity structure.
  • Detection window: The seven-round detection window for mean ARI is motivated by the short actionable lifetime of campaign signals.
  • Contrastive scaling: The effective contrastive strength scales with the number of IoC-bearing batches, so λ=1.0 is not directly portable across datasets with different IoC-match counts.The passage identifies rescaling λ by Phase II step count, or separating the server learning rate from η, as a natural cross-dataset reformulation.

B Threat Model and Privacy Properties

FedIoC keeps raw IoC patterns on clients and transmits blended gradients, but assumes honest participants and does not protect against several leakage, poisoning, or misuse threats. Differential privacy for the IoC gradient component remains future work.

  • Trust assumptions: FedIoC assumes an honest-but-curious server and honest clients, while guaranteeing that raw IoC patterns never leave the client.Only the blended gradient is transmitted, and empty indicator sets reduce the update to standard FedAvg.
  • Threat boundaries: The protocol does not defend against gradient inversion, malicious indicator injection, or a compromised server using the cohort report offensively.The cohort graph itself is identified as a sensitive artifact outside FedIoC’s protocol guarantees.
  • Leakage risks: IoC-contrastive gradients encode IoC membership, making matched source IPs more direct inversion targets than under the CE component alone.Per-round observation compounds leakage across rounds as a separate channel.
  • Mitigations and open work: Secure aggregation is incompatible with the per-client visibility required for clustering, so the proposed mitigation is per-client differential privacy on the IoC component.FedIoC provides no formal differential-privacy guarantee; bounding the IoC gradient and applying DP are left to future work.
Loading 2609.04815v1…