DeepAI AI Chat
Log In Sign Up

CELEST: Federated Learning for Globally Coordinated Threat Detection

by   Talha Ongun, et al.

The cyber-threat landscape has evolved tremendously in recent years, with new threat variants emerging daily, and large-scale coordinated campaigns becoming more prevalent. In this study, we propose CELEST (CollaborativE LEarning for Scalable Threat detection), a federated machine learning framework for global threat detection over HTTP, which is one of the most commonly used protocols for malware dissemination and communication. CELEST leverages federated learning in order to collaboratively train a global model across multiple clients who keep their data locally, thus providing increased privacy and confidentiality assurances. Through a novel active learning component integrated with the federated learning technique, our system continuously discovers and learns the behavior of new, evolving, and globally-coordinated cyber threats. We show that CELEST is able to expose attacks that are largely invisible to individual organizations. For instance, in one challenging attack scenario with data exfiltration malware, the global model achieves a three-fold increase in Precision-Recall AUC compared to the local model. We deploy CELEST on two university networks and show that it is able to detect the malicious HTTP communication with high precision and low false positive rates. Furthermore, during its deployment, CELEST detected a set of previously unknown 42 malicious URLs and 20 malicious domains in one day, which were confirmed to be malicious by VirusTotal.


page 1

page 7


Anomaly Detection via Federated Learning

Machine learning has helped advance the field of anomaly detection by in...

SecFL: Confidential Federated Learning using TEEs

Federated Learning (FL) is an emerging machine learning paradigm that en...

Métodos para la Selección y el Ajuste de Características en el Problema de la Detección de Spam

The email is used daily by millions of people to communicate around the ...

Neural Classification of Malicious Scripts: A study with JavaScript and VBScript

Malicious scripts are an important computer infection threat vector. Our...

PORTFILER: Port-Level Network Profiling for Self-Propagating Malware Detection

Recent self-propagating malware (SPM) campaigns compromised hundred of t...

Towards Effective Cybercrime Intervention

Cybercrimes are on the rise, in part due to technological advancements, ...

Characterizing Certain DNS DDoS Attacks

This paper details data science research in the area of Cyber Threat Int...