基于联邦对比学习的分布式系统行为异常检测
Behavioral Anomaly Detection in Distributed Systems via Federated Contrastive Learning
AI总结：
本文提出一种基于联邦对比学习的分布式系统异常检测方法，结合联邦学习与对比学习在保护隐私的同时优化全局模型，有效提升了细粒度异常模式的检测准确性与适应性。
摘要：
本文探讨了分布式系统中日益突出的异常检测问题，提出了一种基于联邦对比学习的检测方法。其目标是克服传统集中式方法在数据隐私、节点异构性和异常模式识别方面的局限性。该方法将联邦学习的分布式协作建模能力与对比学习的特征判别增强相结合。它在本地节点上构建嵌入表示，并构建正负样本对，以指导模型学习更具判别性的特征空间。在不暴露原始数据的情况下，该方法通过联邦聚合策略优化全局模型。具体而言，该方法使用编码器将本地行为数据表示在高维空间中。这些数据包括系统日志、操作指标和系统调用。模型使用对比损失和分类损失进行训练，以提高其检测细粒度异常模式的能力。该方法在多种典型攻击类型下进行了评估，并在模拟的实时数据流场景中进行了测试，以检验其响应能力。实验结果表明，该方法在多个性能指标上优于现有方法。它展现出强大的检测准确性和适应性，能够有效应对分布式环境中的复杂异常。通过对关键模块的精心设计和训练机制的优化，该方法在隐私保护和检测性能之间实现了平衡，为分布式系统的智能安全管理提供了一条可行的技术路径。
英文摘要：
This paper addresses the increasingly prominent problem of anomaly detection in distributed systems. It proposes a detection method based on federated contrastive learning. The goal is to overcome the limitations of traditional centralized approaches in terms of data privacy, node heterogeneity, and anomaly pattern recognition. The proposed method combines the distributed collaborative modeling capabilities of federated learning with the feature discrimination enhancement of contrastive learning. It builds embedding representations on local nodes and constructs positive and negative sample pairs to guide the model in learning a more discriminative feature space. Without exposing raw data, the method optimizes a global model through a federated aggregation strategy. Specifically, the method uses an encoder to represent local behavior data in high-dimensional space. This includes system logs, operational metrics, and system calls. The model is trained using both contrastive loss and classification loss to improve its ability to detect fine-grained anomaly patterns. The method is evaluated under multiple typical attack types. It is also tested in a simulated real-time data stream scenario to examine its responsiveness. Experimental results show that the proposed method outperforms existing approaches across multiple performance metrics. It demonstrates strong detection accuracy and adaptability, effectively addressing complex anomalies in distributed environments. Through careful design of key modules and optimization of the training mechanism, the proposed method achieves a balance between privacy preservation and detection performance. It offers a feasible technical path for intelligent security management in distributed systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
