FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection

TL;DR

FedLAD is a versatile testbed designed to facilitate federated log anomaly detection research by supporting diverse models, datasets, and adaptive strategies, addressing privacy and decentralization challenges.

Contribution

It introduces FedLAD, a modular platform that enables reproducible, scalable, and adaptive federated LAD experiments, filling a gap in existing FL frameworks.

Findings

Supports plug-and-play LAD models and datasets

Enables adaptive strategy control and self-monitoring

Facilitates reproducible federated LAD research

Abstract

Log-based anomaly detection (LAD) is critical for ensuring the reliability of large-scale distributed systems. However, most existing LAD approaches assume centralized training, which is often impractical due to privacy constraints and the decentralized nature of system logs. While federated learning (FL) offers a promising alternative, there is a lack of dedicated testbeds tailored to the needs of LAD in federated settings. To address this, we present FedLAD, a unified platform for training and evaluating LAD models under FL constraints. FedLAD supports plug-and-play integration of diverse LAD models, benchmark datasets, and aggregation strategies, while offering runtime support for validation logging (self-monitoring), parameter tuning (self-configuration), and adaptive strategy control (self-adaptation). By enabling reproducible and scalable experimentation, FedLAD bridges the gap between FL frameworks and LAD requirements, providing a solid foundation for future research. Project code is publicly available at: https://github.com/AA-cityu/FedLAD.