Cerberus: Exploring Federated Prediction of Security Events - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2022

Cerberus: Exploring Federated Prediction of Security Events

Abstract

Modern defenses against cyberattacks increasingly rely on proactive approaches, e.g., to predict the adversary’s next actions based on past events. Building accurate prediction models requires knowledge from many organizations; alas, this entails disclosing sensitive information, such as network structures, security postures, and policies, which might often be undesirable or outright impossible. In this paper, we explore the feasibility of using Federated Learning (FL) to predict future security events. To this end, we introduce Cerberus, a system enabling collaborative training of Recurrent Neural Network (RNN) models for participating organizations. The intuition is that FL could potentially offer a middle-ground between the non-private approach where the training data is pooled at a central server and the low-utility alternative of only training local models. We instantiate Cerberus on a dataset obtained from a major security company’s intrusion prevention product and evaluate it vis-à-vis utility, robustness, and privacy, as well as how participants contribute to and benefit from the system. Overall, our work sheds light on both the positive aspects and the challenges of using FL for this task and paves the way for deploying federated approaches to predictive security.

Dates and versions

hal-03893491 , version 1 (11-12-2022)

Identifiers

Cite

Mohammad Naseri, Yufei Han, Enrico Mariconti, Yun Shen, Gianluca Stringhini, et al.. Cerberus: Exploring Federated Prediction of Security Events. CCS '22 - ACM SIGSAC Conference on Computer and Communications Security, Nov 2022, Los Angeles CA, United States. pp.2337-2351, ⟨10.1145/3548606.3560580⟩. ⟨hal-03893491⟩
41 View
0 Download

Altmetric

Share

Gmail Facebook X LinkedIn More