Modern defenses against cyberattacks increasingly rely on proactive
approaches, e.g., to predict the adversary's next actions based on past events.
Building accurate prediction models requires knowledge from many organizations;
alas, this entails disclosing sensitive information, such as network
structures, security postures, and policies, which might often be undesirable
or outright impossible. In this paper, we explore the feasibility of using
Federated Learning (FL) to predict future security events. To this end, we
introduce Cerberus, a system enabling collaborative training of Recurrent
Neural Network (RNN) models for participating organizations. The intuition is
that FL could potentially offer a middle-ground between the non-private
approach where the training data is pooled at a central server and the
low-utility alternative of only training local models. We instantiate Cerberus
on a dataset obtained from a major security company's intrusion prevention
product and evaluate it vis-a-vis utility, robustness, and privacy, as well as
how participants contribute to and benefit from the system. Overall, our work
sheds light on both the positive aspects and the challenges of using FL for
this task and paves the way for deploying federated approaches to predictive
security.

本研究旨在探讨使用联邦学习来预测未来的安全事件，我们引入了 Cerberus 系统，使参与组织可以协同训练递归神经网络模型，评估其效用、鲁棒性和隐私，并讨论了使用联邦学习在预测安全性方面所面临的挑战和机会。