aiqbench analysis
This research introduces FedIoC, a federated learning framework that encodes cyber threat indicators directly into gradient updates to detect cross-organizational attack campaigns without sharing sensitive raw data. By leveraging supervised contrastive loss, the system aligns gradient components from different clients to reconstruct global campaign patterns solely through geometric analysis of update vectors. The study highlights how non-IID data distributions drive this recovery mechanism, offering a novel approach to collaborative cybersecurity defense in privacy-preserving environments.
Federated Attack Campaign Detection via Contrastive Encoding of Threat Indicators in Gradient Updates
arXiv:2609.04815v1 Announce Type: new Abstract: Detecting orchestrated cyberattack campaigns that span multiple organizations traditionally requires sharing sensitive telemetry and threat intelligence across institutional boundaries and country borders, a barrier that Federated Learning removes by training shared threat detectors directly on local data. We propose FedIoC, a modular framework in which clients fold locally available structured threat indicators into their gradient updates; we instantiate the client-side encoder with a supervised contrastive loss over IoC-matched flows. Within each training batch, flows that match any known indicator pattern form the positive set; the contrastive objective pulls their learned embeddings together and pushes non-IoC embeddings away, so that campaign-relevant structure is, by design, expressed in the gradient direction. Clients sharing indicators for the same attack campaign then produce aligned gradient components, which the server clusters by the cosine similarity of their updates to recover global campaign patterns without any direct IoC transmission. We evaluate FedIoC on two public threat-detection benchmarks distributed across FL clients that each observe only a fragment of every active campaign and hold disjoint indicator sets derived from their local telemetry. In this regime the FL server recovers cross-organizational campaign cohorts directly from gradient geometry. We contribute FedIoC as a modular framework for this setting, and use it to pinpoint the non-IID gradient structure as the main driver of recovery and to define the open problem of designing encoders that improve on it.
Abstract:Detecting orchestrated cyberattack campaigns that span multiple organizations traditionally requires sharing sensitive telemetry and threat intelligence across institutional boundaries and country borders, a barrier that Federated Learning removes by training shared threat detectors directly on local data. We propose FedIoC, a modular framework in which clients fold locally available structured threat indicators into their gradient updates; we instantiate the client-side encoder with a supervised contrastive loss over IoC-matched flows. Within each training batch, flows that match any known indicator pattern form the positive set; the contrastive objective pulls their learned embeddings together and pushes non-IoC embeddings away, so that campaign-relevant structure is, by design, expressed in the gradient direction. Clients sharing indicators for the same attack campaign then produce aligned gradient components, which the server clusters by the cosine similarity of their updates to recover global campaign patterns without any direct IoC transmission. We evaluate FedIoC on two public threat-detection benchmarks distributed across FL clients that each observe only a fragment of every active campaign and hold disjoint indicator sets derived from their local telemetry. In this regime the FL server recovers cross-organizational campaign cohorts directly from gradient geometry. We contribute FedIoC as a modular framework for this setting, and use it to pinpoint the non-IID gradient structure as the main driver of recovery and to define the open problem of designing encoders that improve on it.
Machine Learning (cs.LG); Cryptography and Security (cs.CR)
arXiv:2609.04815 [cs.LG]
(or arXiv:2609.04815v1 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2609.04815 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 325 words
Related coverage
Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit
Sysdig Blog · Sep 11, 2026
Top 10 Malware Used by Hackers Last Week to Launch Cyberattacks
Cybersecurity News · Jul 21, 2026
Sen. Adam Schiff on AI regulation, free speech, and impeaching Trump one more time
The Verge · Oct 5, 2026
JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models
Sysdig Blog · Jul 20, 2026