<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-03893491</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-17T04:25:14+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Cerberus: Exploring Federated Prediction of Security Events</title>
            <author role="aut">
              <persName>
                <forename type="first">Mohammad</forename>
                <surname>Naseri</surname>
              </persName>
              <idno type="halauthorid">1462440-0</idno>
              <affiliation ref="#struct-300875"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Yufei</forename>
                <surname>Han</surname>
              </persName>
              <idno type="halauthorid">498181-0</idno>
              <affiliation ref="#struct-490909"/>
              <affiliation ref="#struct-419153"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Enrico</forename>
                <surname>Mariconti</surname>
              </persName>
              <idno type="halauthorid">2671836-0</idno>
              <affiliation ref="#struct-300875"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Yun</forename>
                <surname>Shen</surname>
              </persName>
              <idno type="halauthorid">1696926-0</idno>
              <affiliation ref="#struct-301673"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Gianluca</forename>
                <surname>Stringhini</surname>
              </persName>
              <idno type="halauthorid">2234185-0</idno>
              <affiliation ref="#struct-119108"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Emiliano</forename>
                <surname>de Cristofaro</surname>
              </persName>
              <idno type="halauthorid">669799-0</idno>
              <affiliation ref="#struct-300875"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Yufei</forename>
                <surname>Han</surname>
              </persName>
              <email type="md5">eb3cf5bb7329525cd6ad56d45f79e986</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2022-12-11 10:41:24</date>
              <date type="whenModified">2026-02-07 05:24:22</date>
              <date type="whenReleased">2022-12-11 10:41:24</date>
              <date type="whenProduced">2022-11-07</date>
              <ref type="externalLink" target="http://arxiv.org/pdf/2209.03050"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="994791">
                <persName>
                  <forename>Yufei</forename>
                  <surname>Han</surname>
                </persName>
                <email type="md5">eb3cf5bb7329525cd6ad56d45f79e986</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-03893491</idno>
            <idno type="halUri">https://inria.hal.science/hal-03893491</idno>
            <idno type="halBibtex">naseri:hal-03893491</idno>
            <idno type="halRefHtml">&lt;i&gt;CCS '22 - ACM SIGSAC Conference on Computer and Communications Security&lt;/i&gt;, Nov 2022, Los Angeles CA, United States. pp.2337-2351, &lt;a target="_blank" href="https://dx.doi.org/10.1145/3548606.3560580"&gt;&amp;#x27E8;10.1145/3548606.3560580&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">CCS '22 - ACM SIGSAC Conference on Computer and Communications Security, Nov 2022, Los Angeles CA, United States. pp.2337-2351, &amp;#x27E8;10.1145/3548606.3560580&amp;#x27E9;</idno>
            <availability status="restricted"/>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-RENNES1">Université de Rennes 1</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="INRIA">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="UNIV-UBS">Université de Bretagne Sud</idno>
            <idno type="stamp" n="INSA-RENNES">Institut National des Sciences Appliquées de Rennes</idno>
            <idno type="stamp" n="INRIA-RENNES">INRIA Rennes - Bretagne Atlantique</idno>
            <idno type="stamp" n="IRISA">Irisa</idno>
            <idno type="stamp" n="IRISA_SET">IRISA_SET</idno>
            <idno type="stamp" n="INRIA_TEST">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="SUP_CIDRE">CIDRE - Confidentialité, Intégrité, Disponibilité et REpartition</idno>
            <idno type="stamp" n="TESTALAIN1">TESTALAIN1</idno>
            <idno type="stamp" n="CENTRALESUPELEC">Ecole CentraleSupélec</idno>
            <idno type="stamp" n="INRIA2">INRIA 2</idno>
            <idno type="stamp" n="UR1-HAL">Publications labos UR1 dans HAL-Rennes 1</idno>
            <idno type="stamp" n="UR1-MATH-STIC">UR1 - publications Maths-STIC</idno>
            <idno type="stamp" n="UR1-UFR-ISTIC">UFR ISTIC Informatique et électronique</idno>
            <idno type="stamp" n="TEST-UR-CSS">TEST Université de Rennes CSS</idno>
            <idno type="stamp" n="CENTRALESUPELEC-SACLAY-VP">CENTRALE SUPELEC SACLAY VP</idno>
            <idno type="stamp" n="UNIV-RENNES">Université de Rennes</idno>
            <idno type="stamp" n="INRIA-RENGRE">INRIA-RENGRE</idno>
            <idno type="stamp" n="UR1-MATH-NUM">Pôle UnivRennes - Mathématiques - Numérique </idno>
            <idno type="stamp" n="CYBERSCHOOL">CyberSchool - Ecole universitaire de recherche en Cybersécurité</idno>
            <idno type="stamp" n="INRIA-ETATSUNIS">Copublications Inria-Etats-Unis</idno>
            <idno type="stamp" n="INRIA-ROYAUMEUNI">INRIA-ROYAUMEUNI</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Cerberus: Exploring Federated Prediction of Security Events</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Mohammad</forename>
                    <surname>Naseri</surname>
                  </persName>
                  <idno type="halauthorid">1462440-0</idno>
                  <affiliation ref="#struct-300875"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Yufei</forename>
                    <surname>Han</surname>
                  </persName>
                  <idno type="halauthorid">498181-0</idno>
                  <affiliation ref="#struct-490909"/>
                  <affiliation ref="#struct-419153"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Enrico</forename>
                    <surname>Mariconti</surname>
                  </persName>
                  <idno type="halauthorid">2671836-0</idno>
                  <affiliation ref="#struct-300875"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Yun</forename>
                    <surname>Shen</surname>
                  </persName>
                  <idno type="halauthorid">1696926-0</idno>
                  <affiliation ref="#struct-301673"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Gianluca</forename>
                    <surname>Stringhini</surname>
                  </persName>
                  <idno type="halauthorid">2234185-0</idno>
                  <affiliation ref="#struct-119108"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Emiliano</forename>
                    <surname>de Cristofaro</surname>
                  </persName>
                  <idno type="halauthorid">669799-0</idno>
                  <affiliation ref="#struct-300875"/>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>CCS '22 - ACM SIGSAC Conference on Computer and Communications Security</title>
                  <date type="start">2022-11-07</date>
                  <date type="end">2022-11-11</date>
                  <settlement>Los Angeles CA</settlement>
                  <country key="US">United States</country>
                </meeting>
                <imprint>
                  <publisher>ACM</publisher>
                  <biblScope unit="pp">2337-2351</biblScope>
                </imprint>
              </monogr>
              <idno type="arxiv">2209.03050</idno>
              <idno type="doi">10.1145/3548606.3560580</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halDomain" n="info.info-ai">Computer Science [cs]/Artificial Intelligence [cs.AI]</classCode>
              <classCode scheme="halDomain" n="info.info-lg">Computer Science [cs]/Machine Learning [cs.LG]</classCode>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halDomain" n="info.info-dc">Computer Science [cs]/Distributed, Parallel, and Cluster Computing [cs.DC]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Modern defenses against cyberattacks increasingly rely on proactive approaches, e.g., to predict the adversary’s next actions based on past events. Building accurate prediction models requires knowledge from many organizations; alas, this entails disclosing sensitive information, such as network structures, security postures, and policies, which might often be undesirable or outright impossible. In this paper, we explore the feasibility of using Federated Learning (FL) to predict future security events. To this end, we introduce Cerberus, a system enabling collaborative training of RecurrentNeural Network (RNN) models for participating organizations. The intuition is that FL could potentially offer a middle-ground between the non-private approach where the training data is pooled at a central server and the low-utility alternative of only training local models. We instantiate Cerberus on a dataset obtained from a major security company’s intrusion prevention product and evaluate it vis-à-vis utility, robustness, and privacy, as well as how participants contribute to and benefit from the system. Overall, our work sheds light on both the positive aspects and the challenges of using FL for this task and paves the way for deploying federated approaches to predictive security.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-300875" status="VALID">
          <idno type="IdRef">029789753</idno>
          <idno type="ROR">https://ror.org/02jx3x895</idno>
          <orgName>University College London [UCL]</orgName>
          <orgName type="acronym">UCL</orgName>
          <desc>
            <address>
              <addrLine>Gower Street, London WC1E 6BT</addrLine>
              <country key="GB"/>
            </address>
            <ref type="url">http://www.ucl.ac.uk/</ref>
          </desc>
        </org>
        <org type="researchteam" xml:id="struct-490909" status="OLD">
          <idno type="RNSR">201120989W</idno>
          <orgName>Confidentialité, Intégrité, Disponibilité et Répartition</orgName>
          <orgName type="acronym">CIDRE</orgName>
          <date type="start">2017-01-01</date>
          <date type="end">2024-02-29</date>
          <desc>
            <address>
              <addrLine>Campus de Beaulieu35042 Rennes cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://team.inria.fr/cidre/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-411575" type="direct"/>
            <relation active="#struct-419153" type="direct"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-490900" type="direct"/>
            <relation active="#struct-490899" type="indirect"/>
            <relation active="#struct-105160" type="indirect"/>
            <relation active="#struct-117606" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="indirect"/>
            <relation active="#struct-247362" type="indirect"/>
            <relation name="UMR6074" active="#struct-441569" type="indirect"/>
            <relation active="#struct-481355" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-419153" status="VALID">
          <idno type="RNSR">198018249C</idno>
          <idno type="ROR">https://ror.org/04040yw90</idno>
          <orgName>Centre Inria de l'Université de Rennes</orgName>
          <desc>
            <address>
              <addrLine>Campus de beaulieu35042 Rennes cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/centre/rennes</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300009" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-301673" status="VALID">
          <orgName>NetApp</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-119108" status="VALID">
          <orgName>Department of Electrical and Computer Engineering [Boston University]</orgName>
          <orgName type="acronym">ECE</orgName>
          <desc>
            <address>
              <addrLine>Building: Photonics Building (PHO) 8 St. Mary's St Boston, MA 02215</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://www.bu.edu/ece/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-63395" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-411575" status="VALID">
          <idno type="IdRef">184443237</idno>
          <idno type="ROR">https://ror.org/019tcpt25</idno>
          <orgName>CentraleSupélec</orgName>
          <desc>
            <address>
              <addrLine>3, rue Joliot Curie,Plateau de Moulon,91192 GIF-SUR-YVETTE Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.centralesupelec.fr</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-300009" status="VALID">
          <idno type="ROR">https://ror.org/02kvxyf05</idno>
          <orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
          <orgName type="acronym">Inria</orgName>
          <desc>
            <address>
              <addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/en/</ref>
          </desc>
        </org>
        <org type="department" xml:id="struct-490900" status="VALID">
          <orgName>SYSTÈMES LARGE ÉCHELLE</orgName>
          <orgName type="acronym">IRISA-D1</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.irisa.fr/fr/departements/d1-systemes-large-echelle</ref>
          </desc>
          <listRelation>
            <relation active="#struct-490899" type="direct"/>
            <relation active="#struct-105160" type="indirect"/>
            <relation active="#struct-117606" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="indirect"/>
            <relation active="#struct-247362" type="indirect"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-411575" type="indirect"/>
            <relation name="UMR6074" active="#struct-441569" type="indirect"/>
            <relation active="#struct-481355" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-490899" status="VALID">
          <idno type="IdRef">026386909</idno>
          <idno type="ISNI">0000 0001 2298 7270</idno>
          <idno type="RNSR">200012163A</idno>
          <idno type="ROR">https://ror.org/00myn0z94</idno>
          <orgName>Institut de Recherche en Informatique et Systèmes Aléatoires</orgName>
          <orgName type="acronym">IRISA</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Avenue du général LeclercCampus de Beaulieu 35042 RENNES CEDEX</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.irisa.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-105160" type="direct"/>
            <relation active="#struct-117606" type="direct"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="direct"/>
            <relation active="#struct-247362" type="direct"/>
            <relation active="#struct-300009" type="direct"/>
            <relation active="#struct-411575" type="direct"/>
            <relation name="UMR6074" active="#struct-441569" type="direct"/>
            <relation active="#struct-481355" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-105160" status="VALID">
          <idno type="IdRef">26693823X</idno>
          <idno type="ROR">https://ror.org/015m7wh34</idno>
          <orgName>Université de Rennes</orgName>
          <orgName type="acronym">UR</orgName>
          <desc>
            <address>
              <addrLine>Campus de Beaulieu, 263 avenue Général Leclerc, CS 74205, 35042 RENNES CEDEX</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.univ-rennes.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-117606" status="VALID">
          <idno type="ROR">https://ror.org/04xaa4j22</idno>
          <orgName>Institut National des Sciences Appliquées - Rennes</orgName>
          <orgName type="acronym">INSA Rennes</orgName>
          <desc>
            <address>
              <addrLine>20, avenue des Buttes de Coësmes - CS 70839 - 35708 Rennes cedex 7</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.insa-rennes.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-301232" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-301232" status="VALID">
          <idno type="IdRef">162105150</idno>
          <orgName>Institut National des Sciences Appliquées</orgName>
          <orgName type="acronym">INSA</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-172265" status="VALID">
          <idno type="IdRef">05017746X</idno>
          <idno type="ISNI">0000000121680285</idno>
          <idno type="ROR">https://ror.org/04ed7fw48</idno>
          <orgName>Université de Bretagne Sud</orgName>
          <orgName type="acronym">UBS</orgName>
          <date type="start">1995-02-07</date>
          <desc>
            <address>
              <addrLine>BP 92116 - 56321 Lorient cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-ubs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-247362" status="VALID">
          <idno type="ROR">https://ror.org/03rxtdc22</idno>
          <orgName>École normale supérieure - Rennes</orgName>
          <orgName type="acronym">ENS Rennes</orgName>
          <desc>
            <address>
              <addrLine>Campus de Ker Lann - avenue Robert Schuman - 35170 Bruz</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ens-rennes.fr</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-481355" status="VALID">
          <idno type="IdRef">202743233</idno>
          <idno type="ROR">https://ror.org/030hj3061</idno>
          <orgName>IMT Atlantique</orgName>
          <orgName type="acronym">IMT Atlantique</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Campus Brest : Technopôle Brest-Iroise CS 8381829238 BREST Cedex 3 -Campus Nantes : 4, rue Alfred Kastler- La chantrerie 44300 NANTES -Campus Rennes :  2 Rue de la Châtaigneraie, 35510 CESSON SEVIGNE</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt-atlantique.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-302102" status="VALID">
          <idno type="IdRef">192427156</idno>
          <idno type="ISNI">000000012202567X</idno>
          <idno type="ROR">https://ror.org/025vp2923</idno>
          <idno type="Wikidata">Q27962533</idno>
          <orgName>Institut Mines-Télécom [Paris]</orgName>
          <orgName type="acronym">IMT</orgName>
          <date type="start">2012-03-01</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey, 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-63395" status="VALID">
          <idno type="IdRef">026472104</idno>
          <idno type="ROR">https://ror.org/05qwgg493</idno>
          <orgName>Boston University [Boston]</orgName>
          <orgName type="acronym">BU</orgName>
          <desc>
            <address>
              <addrLine>One Silber Way, Boston, MA 02215</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://www.bu.edu/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>