FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection.
Abstract
Log-based anomaly detection (LAD) is critical for ensuring the reliability of large-scale distributed systems. However, most existing LAD approaches assume centralized training, which is often impractical due to privacy constraints and the decentralized nature of system logs. While federated learning (FL) offers a promising alternative, there is a lack of dedicated testbeds tailored to the needs of LAD in federated settings. To address this, we present FedLAD, a unified platform for training and evaluating LAD models under FL constraints. FedLAD supports plugand-play integration of diverse LAD models, benchmark datasets, and aggregation strategies, while offering runtime support for validation logging (self-monitoring), parameter tuning (selfconfiguration), and adaptive strategy control (self-adaptation). By enabling reproducible and scalable experimentation, FedLAD bridges the gap between FL frameworks and LAD requirements, providing a solid foundation for future research. Project code is publicly available at: https://github.com/AA-cityu/FedLAD. Index Terms-Federated Learning, Log Anomaly Detection, Testbed, Self-adaptive System I. I NTRODUCTION Modern large-scale software systems, ranging from distributed cloud platforms to edge computing infrastructures, generate massive volumes of system logs that record detailed runtime behaviors [1]. These logs are critical for diagnosing failures, monitoring performance, and ensuring reliability. Given the scale and complexity, manual inspection is infeasible. As a result, Log-based Anomaly Detection (LAD) has become a vital approach for automatically identifying abnormal behaviors and potential faults [2], and it has been successfully applied in diverse domains such as data centers, Internet of Things, and autonomous vehicles [3]. Despite their effectiveness, existing LAD models face several critical limitations. Many assume centralized training with globally accessible logs, which is an impractical assumption due to privacy concerns and organizational data silos. This constraint hinders cross-organizational collaboration, particularly when sensitive operational logs cannot be shared across institutional boundaries [4