Federated Attack Campaign Detection via Contrastive Encoding of Threat Indicators in Gradient Updates

The researchers proposed the FedIoC framework, aimed at detecting coordinated network attacks across organizations. This framework utilizes contrast coding techniques to fold local structured threat indicators into gradient updates, and employs supervised contrast loss to embed traffic matching known indicators into an aggregate, thereby expressing attack-related structures in the gradient direction. Servers cluster client updates based on gradient cosine similarity, allowing recovery of global attack patterns without the need for direct transmission of threat intelligence. The effectiveness of the framework was verified on two publicly available threat detection benchmarks, demonstrating that federated learning servers can directly reconstruct cross-organizational attack gangs from gradient geometry.