Dynamic Federated Edge Anomaly Detection Based on Dual Fuzzing Strategies

With the rapid proliferation of edge computing, mobile edges interconnected via networks are increasingly ex posed to a wide range of attacks. Considering privacy concerns, federated edge anomaly detection, collaboratively training a global detection model across multiple edge clients without centralizing sensitive data, is a promising paradigm to detecting such attacks. However, mobile edge environment is inherently dynamic, with frequent evolving in both network traffic and participating clients. Most existing methods are pre-defined for specific attacks and fixed client settings, which significantly limits their adaptability in dynamic mobile edges. To address these issues, we define the federated adaptability from both data-level and client-level perspectives for the first time, and derive the decisive factors for improving adaptability, i.e., high smoothness and low gradient similarity. Driven by this theoretical foundation, we propose DIFF, a federated edge anomaly detection framework based on dual fuzzing strategies. DIFF incorporates two novel designs for improving adaptability: (i) a classless fuzzing strategy to improve data-level adaptability by fuzzing the boundary between normal and abnormal samples, thereby encouraging model smoothness and enhancing adaptability to unseen traffic and emerging attacks; and (ii) a direction fuzzing strategy to enhance client-level adaptability by perturbing the optimization directions of local models, enabling the aggregated global model to adapt effectively to new clients. Experiments on public datasets demonstrate the superior adapt ability of DIFF compared to the state-of-art methods.