Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection

Yihan Liao, Jacky Keung, Zhenyu Mao, Jingyu Zhang, Jialong Li

TL;DR

FedLAD presents a modular, self-adaptive testbed for federated log anomaly detection, addressing the lack of dedicated FL environments for LAD by decoupling models, datasets, and aggregation strategies. It integrates a MAP-based self-adaptation loop, self-monitoring, and auto-configuration to enable reproducible and scalable experimentation across IID and non-IID log data. The platform supports plug-and-play LAD architectures, benchmark datasets, and multiple FL aggregators, demonstrating concrete gains from adaptive control and comparable performance to centralized baselines with added privacy benefits. By providing end-to-end tooling, FedLAD accelerates reproducible research and rapid prototyping of privacy-preserving, scalable LAD in federated settings.

Abstract

Log-based anomaly detection (LAD) is critical for ensuring the reliability of large-scale distributed systems. However, most existing LAD approaches assume centralized training, which is often impractical due to privacy constraints and the decentralized nature of system logs. While federated learning (FL) offers a promising alternative, there is a lack of dedicated testbeds tailored to the needs of LAD in federated settings. To address this, we present FedLAD, a unified platform for training and evaluating LAD models under FL constraints. FedLAD supports plug-and-play integration of diverse LAD models, benchmark datasets, and aggregation strategies, while offering runtime support for validation logging (self-monitoring), parameter tuning (self-configuration), and adaptive strategy control (self-adaptation). By enabling reproducible and scalable experimentation, FedLAD bridges the gap between FL frameworks and LAD requirements, providing a solid foundation for future research. Project code is publicly available at: https://github.com/AA-cityu/FedLAD.

FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection

TL;DR

FedLAD presents a modular, self-adaptive testbed for federated log anomaly detection, addressing the lack of dedicated FL environments for LAD by decoupling models, datasets, and aggregation strategies. It integrates a MAP-based self-adaptation loop, self-monitoring, and auto-configuration to enable reproducible and scalable experimentation across IID and non-IID log data. The platform supports plug-and-play LAD architectures, benchmark datasets, and multiple FL aggregators, demonstrating concrete gains from adaptive control and comparable performance to centralized baselines with added privacy benefits. By providing end-to-end tooling, FedLAD accelerates reproducible research and rapid prototyping of privacy-preserving, scalable LAD in federated settings.

Abstract

Log-based anomaly detection (LAD) is critical for ensuring the reliability of large-scale distributed systems. However, most existing LAD approaches assume centralized training, which is often impractical due to privacy constraints and the decentralized nature of system logs. While federated learning (FL) offers a promising alternative, there is a lack of dedicated testbeds tailored to the needs of LAD in federated settings. To address this, we present FedLAD, a unified platform for training and evaluating LAD models under FL constraints. FedLAD supports plug-and-play integration of diverse LAD models, benchmark datasets, and aggregation strategies, while offering runtime support for validation logging (self-monitoring), parameter tuning (self-configuration), and adaptive strategy control (self-adaptation). By enabling reproducible and scalable experimentation, FedLAD bridges the gap between FL frameworks and LAD requirements, providing a solid foundation for future research. Project code is publicly available at: https://github.com/AA-cityu/FedLAD.

Paper Structure

This paper contains 21 sections, 5 figures.

Table of Contents

  1. Introduction
  2. Background
  3. Log Anomaly Detection
  4. Federated Learning-based Log Anomaly Detection
  5. System Design
  6. FedLAD Architecture
  7. System Workflow
  8. Implementation
  9. Deployment Environment
  10. Implementation Details
  11. Configuration Management
  12. Dataset and Model Handling
  13. Federated Training Engine
  14. Aggregation Strategy Implementation
  15. Executor and Adaptation Logic
  16. ...and 6 more sections

Figures (5)

  • Figure 1: Overview of the architecture of FedLAD.
  • Figure 2: Federated learning workflow in FedLAD.
  • Figure 3: Two-stage lifecycle in FedLAD.
  • Figure 4: Detection performance in FedLAD. Parameter settings: dataset = Thunderbird, distribution = non-IID, model = LogAnomaly.
  • Figure 5: Example of the final evaluation report with adaptive control enabled. Parameter settings: dataset = Thunderbird, distribution = IID, model = NeuralLog.