{"id":"https://openalex.org/W7160628697","doi":"https://doi.org/10.48550/arxiv.2605.06571","title":"CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification","display_name":"CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification","publication_year":2026,"publication_date":"2026-05-07","ids":{"openalex":"https://openalex.org/W7160628697","doi":"https://doi.org/10.48550/arxiv.2605.06571"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.06571","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.06571","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.06571","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053398628","display_name":"Iason Ofeidis","orcid":"https://orcid.org/0000-0001-8206-8321"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ofeidis, Iason","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120355267","display_name":"Nikos Papadis","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Papadis, Nikos","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135708994","display_name":"Randeep Bhatia","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bhatia, Randeep","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135723378","display_name":"Leandros Tassiulas","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tassiulas, Leandros","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135722075","display_name":"TV Lakshman","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lakshman, TV","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5514000058174133,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5514000058174133,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.093299999833107,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.0794999971985817,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.6596999764442444},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6008999943733215},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5809000134468079},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5730000138282776},{"id":"https://openalex.org/keywords/federated-learning","display_name":"Federated learning","score":0.5703999996185303},{"id":"https://openalex.org/keywords/joint","display_name":"Joint (building)","score":0.541700005531311},{"id":"https://openalex.org/keywords/encoder","display_name":"Encoder","score":0.5085999965667725},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.5080000162124634},{"id":"https://openalex.org/keywords/enhanced-data-rates-for-gsm-evolution","display_name":"Enhanced Data Rates for GSM Evolution","score":0.4521999955177307},{"id":"https://openalex.org/keywords/supervised-learning","display_name":"Supervised learning","score":0.39259999990463257}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8130000233650208},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.6596999764442444},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6008999943733215},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5809000134468079},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5730000138282776},{"id":"https://openalex.org/C2992525071","wikidata":"https://www.wikidata.org/wiki/Q50818671","display_name":"Federated learning","level":2,"score":0.5703999996185303},{"id":"https://openalex.org/C18555067","wikidata":"https://www.wikidata.org/wiki/Q8375051","display_name":"Joint (building)","level":2,"score":0.541700005531311},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.5085999965667725},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.5080000162124634},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4645000100135803},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.4521999955177307},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42980000376701355},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.39259999990463257},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.39149999618530273},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.37040001153945923},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.37040001153945923},{"id":"https://openalex.org/C138236772","wikidata":"https://www.wikidata.org/wiki/Q25098575","display_name":"Edge device","level":3,"score":0.3321000039577484},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.31869998574256897},{"id":"https://openalex.org/C70061542","wikidata":"https://www.wikidata.org/wiki/Q989016","display_name":"Distributed database","level":2,"score":0.3041999936103821},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.3037000000476837},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2964000105857849},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2906999886035919},{"id":"https://openalex.org/C58973888","wikidata":"https://www.wikidata.org/wiki/Q1041418","display_name":"Semi-supervised learning","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.2815000116825104},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.2777000069618225},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2768000066280365},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.27489998936653137},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2685999870300293},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.2590000033378601},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2563000023365021},{"id":"https://openalex.org/C24590314","wikidata":"https://www.wikidata.org/wiki/Q336038","display_name":"Wireless sensor network","level":2,"score":0.2524000108242035},{"id":"https://openalex.org/C2776145971","wikidata":"https://www.wikidata.org/wiki/Q30673951","display_name":"Labeled data","level":2,"score":0.25209999084472656}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.06571","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.06571","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.06571","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.06571","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.41691142320632935,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0,105],"rapid":[1],"expansion":[2],"of":[3,6,57,97],"the":[4,54,93,127,139,199],"Internet":[5],"Things":[7],"(IoT)":[8],"and":[9,49,102,121,135,165],"Industrial":[10],"IoT":[11,98],"(IIoT)":[12],"has":[13],"created":[14],"a":[15,31,72,83,109,183],"massive,":[16],"heterogeneous":[17],"attack":[18,123],"surface":[19],"that":[20,75,160,174],"challenges":[21],"traditional":[22],"network":[23],"security":[24],"mechanisms.":[25],"While":[26],"Federated":[27,79],"Learning":[28,80],"(FL)":[29],"offers":[30],"privacy-preserving":[32],"alternative":[33],"to":[34,43,52,129],"centralized":[35],"Intrusion":[36],"Detection":[37],"Systems":[38],"(IDS),":[39],"standard":[40],"approaches":[41],"struggle":[42],"generalize":[44],"across":[45],"diverse":[46],"device":[47,100],"behaviors":[48],"typically":[50],"fail":[51],"utilize":[53],"vast":[55],"amounts":[56],"unlabeled":[58,136,194],"data":[59,162],"present":[60],"in":[61,187,190],"realistic":[62],"edge":[63],"environments.":[64],"To":[65],"bridge":[66],"these":[67,156],"gaps,":[68],"we":[69],"propose":[70],"CLAD,":[71],"holistic":[73],"framework":[74,128],"seamlessly":[76],"incorporates":[77],"Clustered":[78],"(CFL)":[81],"with":[82,145,192,196],"novel":[84],"Dual-Mode":[85],"Micro-Architecture":[86],"($\\text{DM}^2\\text{A}$).":[87],"This":[88],"unified":[89],"approach":[90,177],"simultaneously":[91],"tackles":[92],"two":[94,114],"primary":[95],"bottlenecks":[96],"security:":[99],"heterogeneity":[101],"label":[103],"scarcity.":[104],"$\\text{DM}^2\\text{A}$":[106],"component":[107,141],"features":[108],"shared":[110],"encoder":[111],"followed":[112],"by":[113],"branches,":[115],"enabling":[116],"joint":[117],"unsupervised":[118],"anomaly":[119],"detection":[120,188],"supervised":[122],"classification;":[124],"this":[125,175],"allows":[126],"harvest":[130],"intelligence":[131],"from":[132],"both":[133],"labeled":[134],"clients.":[137],"Concurrently,":[138],"clustering":[140],"dynamically":[142],"groups":[143],"devices":[144],"congruent":[146],"traffic":[147],"patterns,":[148],"preventing":[149],"global":[150],"model":[151],"divergence.":[152],"By":[153],"carefully":[154],"combining":[155],"elements,":[157],"CLAD":[158],"ensures":[159],"no":[161],"is":[163],"discarded":[164],"distinct":[166],"operational":[167],"patterns":[168],"are":[169],"preserved.":[170],"Extensive":[171],"evaluations":[172],"demonstrate":[173],"integrated":[176],"significantly":[178],"outperforms":[179],"state-of-the-art":[180],"baselines,":[181],"achieving":[182],"30%":[184],"relative":[185],"improvement":[186],"performance":[189],"scenarios":[191],"80%":[193],"clients,":[195],"only":[197],"half":[198],"communication":[200],"cost.":[201]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-09T00:00:00"}