{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T02:47:32Z","timestamp":1782096452403,"version":"3.54.5"},"reference-count":33,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T00:00:00Z","timestamp":1782086400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T00:00:00Z","timestamp":1782086400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"BUPT Excellent Ph.D. Students Foundation","award":["CX2023221"],"award-info":[{"award-number":["CX2023221"]}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["3282023012"],"award-info":[{"award-number":["3282023012"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["3282023033"],"award-info":[{"award-number":["3282023033"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    Anomaly detection in multivariate time series is critical for system status monitoring, particularly in healthcare surveillance. However, centralized anomaly detection in cloud-edge collaborative environments may raise privacy concerns. This paper proposes a Federated Aggregation Optimization-based Privacy-Preserving Anomaly Detection Framework for Time Series (FAPAD). The FAPAD framework mitigates the risk of privacy leakage by distributing data anomaly detection tasks across multiple edge nodes and deploying model anomaly detection and parameter aggregation modules on the cloud. Specifically, we integrate a deep anomaly detection method for multivariate time-series data in the anomaly detection module to ensure detection performance. This method employs an adversarial Transformer feature learning model to capture the feature representations of the time-series data. Anomaly scores and decision thresholds are then calculated using an anomaly interpretation method to enable effective differentiation between normal and anomalous data. Furthermore, the differential privacy technique is employed to protect the privacy of both the model and data during the parameter upload phase, thus preventing model inference attacks. In the parameter aggregation module, a federated aggregation optimization strategy is designed, which combines the\n                    <jats:italic>F<\/jats:italic>\n                    1 score and\n                    <jats:inline-formula>\n                      <jats:alternatives>\n                        <jats:tex-math>$$L_2$$<\/jats:tex-math>\n                        <mml:math xmlns:mml=\"http:\/\/www.w3.org\/1998\/Math\/MathML\">\n                          <mml:msub>\n                            <mml:mi>L<\/mml:mi>\n                            <mml:mn>2<\/mml:mn>\n                          <\/mml:msub>\n                        <\/mml:math>\n                      <\/jats:alternatives>\n                    <\/jats:inline-formula>\n                    distance to assign aggregation weights to local model parameters, thereby reducing the impact of anomalous models on the global aggregation outcome. Extensive experiments conducted on four public datasets demonstrate the effectiveness of the proposed FAPAD framework.\n                  <\/jats:p>","DOI":"10.1186\/s42400-025-00511-0","type":"journal-article","created":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T02:03:16Z","timestamp":1782093796000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["FAPAD: a federated aggregation optimization-based privacy-preserving anomaly detection framework for time series"],"prefix":"10.1186","volume":"9","author":[{"given":"Kejun","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8891-6723","authenticated-orcid":false,"given":"Xinying","family":"Yu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jun","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenbin","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Meijiao","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yucheng","family":"Yan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ying","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,6,22]]},"reference":[{"key":"511_CR1","first-page":"6481","volume":"7","author":"AA Cook","year":"2020","unstructured":"Cook AA, Misirli G, Fan Z (2020) Anomaly detection for Iot time-series data: a survey. IEEE Int Things J 7:6481\u20136494","journal-title":"IEEE Int Things J"},{"key":"511_CR2","unstructured":"Yuan S, Wu X (2022) Trustworthy anomaly detection: a survey. ArXiv abs\/2202.07787"},{"key":"511_CR3","first-page":"1","volume":"2","author":"RA Sater","year":"2020","unstructured":"Sater RA, Hamza AB (2020) A federated learning approach to anomaly detection in smart buildings. ACM Trans Int Things 2:1\u201323","journal-title":"ACM Trans Int Things"},{"key":"511_CR4","doi-asserted-by":"crossref","unstructured":"Zhang T, He C, Ma T-S, Ma M, Avestimehr S (2021) Federated learning for internet of things. In: Proceedings of the 19th ACM Conference on Embedded Networked Sensor Systems","DOI":"10.1145\/3485730.3493444"},{"key":"511_CR5","first-page":"6348","volume":"8","author":"Y Liu","year":"2020","unstructured":"Liu Y, Garg S, Nie J, Zhang Y, Xiong Z, Kang J, Hossain MS (2020) Deep anomaly detection for time-series data in industrial iot: A communication-efficient on-device federated learning approach. IEEE Int Things J 8:6348\u20136358","journal-title":"IEEE Int Things J"},{"key":"511_CR6","doi-asserted-by":"publisher","first-page":"3492","DOI":"10.1109\/TII.2021.3107783","volume":"18","author":"L Cui","year":"2021","unstructured":"Cui L, Qu Y, Xie G, Zeng D, Li R, Shen S, Yu S (2021) Security and privacy-enhanced federated learning for anomaly detection in iot infrastructures. IEEE Trans Industr Inf 18:3492\u20133500","journal-title":"IEEE Trans Industr Inf"},{"key":"511_CR7","doi-asserted-by":"publisher","first-page":"2200","DOI":"10.1109\/TII.2022.3199228","volume":"19","author":"J Jiang","year":"2023","unstructured":"Jiang J, Zhu J, Bilal M, Cui Y, Kumar N, Dou R, Su F, Xu X (2023) Masked Swin transformer unet for industrial anomaly detection. IEEE Trans Industr Inf 19:2200\u20132209","journal-title":"IEEE Trans Industr Inf"},{"key":"511_CR8","doi-asserted-by":"publisher","first-page":"15","DOI":"10.1109\/TIFS.2022.3216479","volume":"18","author":"T Liu","year":"2023","unstructured":"Liu T, Zhang C, Lam KM, Kong J (2023) Decouple and resolve: transformer-based models for online anomaly detection from weakly labeled videos. IEEE Trans Inf Forensics Secur 18:15\u201328","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"511_CR9","doi-asserted-by":"crossref","unstructured":"Zhang K, Jiang Y, Seversky LM, Xu C, Liu D, Song HH (2021) Federated variational learning for anomaly detection in multivariate time series. In: 2021 IEEE International Performance, Computing, and Communications Conference (IPCCC), 1\u20139","DOI":"10.1109\/IPCCC51483.2021.9679367"},{"key":"511_CR10","first-page":"7110","volume":"9","author":"X Wang","year":"2022","unstructured":"Wang X, Garg S, Lin H, Hu J, Kaddoum G, Piran MJ, Hossain MS (2022) Toward accurate anomaly detection in industrial internet of things using hierarchical federated learning. IEEE Int Things J 9:7110\u20137119","journal-title":"IEEE Int Things J"},{"key":"511_CR11","doi-asserted-by":"publisher","first-page":"468","DOI":"10.1109\/JRFID.2024.3390142","volume":"8","author":"Z Zhang","year":"2024","unstructured":"Zhang Z, Zhang W, Bao Z, Miao Y, Liu Y, Zhao Y, Zhang R, Zhu W (2024) A personalized and differentially private federated learning for anomaly detection of industrial equipment. IEEE J Radio Freq Identif 8:468\u2013475","journal-title":"IEEE J Radio Freq Identif"},{"key":"511_CR12","doi-asserted-by":"publisher","first-page":"252","DOI":"10.23919\/JCN.2024.000016","volume":"26","author":"X Jin","year":"2024","unstructured":"Jin X, Ma C, Luo S, Zeng P, Wei Y (2024) Distributed iiot anomaly detection scheme based on blockchain and federated learning. J Commun Netw 26:252\u2013262","journal-title":"J Commun Netw"},{"key":"511_CR13","doi-asserted-by":"publisher","DOI":"10.1016\/j.csi.2022.103707","volume":"85","author":"S Chen","year":"2022","unstructured":"Chen S, Susilo W, Zhang Y, Yang B, Zhang M (2022) Privacy-preserving anomaly counting for time-series data in edge-assisted crowdsensing. Comput Stand Interfaces 85:103707","journal-title":"Comput Stand Interfaces"},{"issue":"4","key":"511_CR14","doi-asserted-by":"publisher","first-page":"857","DOI":"10.1109\/TDSC.2018.2881452","volume":"17","author":"J Feng","year":"2018","unstructured":"Feng J, Yang LT, Zhu Q, Choo K-KR (2018) Privacy-preserving tensor decomposition over encrypted data in a federated cloud environment. IEEE Trans Dependable Secure Comput 17(4):857\u2013868","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"511_CR15","doi-asserted-by":"crossref","unstructured":"Feng J, Wu Y, Sun H, Zhang S, Liu D (2025)Panther: Practical secure 2-party neural network inference. IEEE Trans Inform Forensics Secur","DOI":"10.1109\/TIFS.2025.3526063"},{"key":"511_CR16","doi-asserted-by":"publisher","first-page":"209","DOI":"10.1016\/j.jpdc.2017.12.011","volume":"127","author":"A Alabdulatif","year":"2019","unstructured":"Alabdulatif A, Khalil I, Kumarage H, Zomaya AY, Yi X (2019) Privacy-preserving anomaly detection in the cloud for quality assured decision-making in smart cities. J Parall Distrib Comput 127:209\u2013223","journal-title":"J Parall Distrib Comput"},{"key":"511_CR17","doi-asserted-by":"crossref","unstructured":"Mehnaz S, Bertino E (2020) Privacy-preserving real-time anomaly detection using edge computing. In: 2020 IEEE 36th International Conference on Data Engineering (ICDE), 469\u2013480","DOI":"10.1109\/ICDE48307.2020.00047"},{"key":"511_CR18","doi-asserted-by":"crossref","unstructured":"Itokazu K, Wang L, Ozawa S(2021) Outlier detection by privacy-preserving ensemble decision tree u sing homomorphic encryption. In: 2021 International Joint Conference on Neural Networks (IJCNN), 1\u20137","DOI":"10.1109\/IJCNN52387.2021.9534464"},{"issue":"7","key":"511_CR19","first-page":"1368","volume":"53","author":"T Li","year":"2023","unstructured":"Li T, Fang B, Ma Z, Shen Y, Ma J (2023) Homomorphic encryption-based ciphertext anomaly detection method for e-health records. SCIENTIA SINICA Inform 53(7):1368\u20131391","journal-title":"SCIENTIA SINICA Inform"},{"issue":"6","key":"511_CR20","first-page":"1","volume":"42","author":"Q Jian","year":"2025","unstructured":"Jian Q, Haiying M, Zhanjun W, Jinyu S (2025) Survey of privacy-preserving aggregation mechanisms in federated learning. Appl Res Comput 42(6):1\u201311","journal-title":"Appl Res Comput"},{"key":"511_CR21","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2022.110213","volume":"261","author":"P Zhang","year":"2023","unstructured":"Zhang P, Cheng X, Su S, Wang N (2023) Effective truth discovery under local differential privacy by leveraging noise-aware probabilistic estimation and fusion. Knowl-Based Syst 261:110213","journal-title":"Knowl-Based Syst"},{"key":"511_CR22","doi-asserted-by":"crossref","unstructured":"Cilakova AC, Pfitzner B, Gjoreski H, Rakovic V, Arnrich B, Kalendar M (2021) Differentially private federated learning for anomaly detection in ehealth networks. Adjunct Proceedings of the 2021 ACM International Joint Conference on Pervasive and Ubiquitous Computing and Proceedings of the 2021 ACM International Symposium on Wearable Computers, 514\u2013518","DOI":"10.1145\/3460418.3479365"},{"key":"511_CR23","doi-asserted-by":"publisher","first-page":"982","DOI":"10.1109\/JSAC.2022.3142302","volume":"40","author":"MN Kurt","year":"2022","unstructured":"Kurt MN, Yilmaz Y, Wang X, Mosterman PJ (2022) Online privacy-preserving data-driven network anomaly detection. IEEE J Sel Areas Commun 40:982\u2013998","journal-title":"IEEE J Sel Areas Commun"},{"key":"511_CR24","doi-asserted-by":"crossref","unstructured":"Fan TG, Zhang Z, Lan Y, Cui Z-S (2021) A many-objective anomaly detection model for vehicle network based on federated learning and differential privacy protection. In: International Symposium on Intelligence Computation and Applications, pp. 52\u201361","DOI":"10.1007\/978-981-19-4109-2_6"},{"key":"511_CR25","doi-asserted-by":"publisher","first-page":"8977","DOI":"10.1109\/TII.2022.3167478","volume":"18","author":"S Ma","year":"2022","unstructured":"Ma S, Nie J, Kang J, Lyu L, Liu RW, Zhao R, Liu Z, Niyato DT (2022) Privacy-preserving anomaly detection in cloud manufacturing via federated transformer. IEEE Trans Industr Inf 18:8977\u20138987","journal-title":"IEEE Trans Industr Inf"},{"key":"511_CR26","unstructured":"Yu X, Zhang K, Liu Y, Zou B, Wang J, Wang W, Qian R (2024) Adversarial transformer-based anomaly detection for multivariate time series. IEEE Trans Ind Inform, 1\u201310"},{"key":"511_CR27","doi-asserted-by":"crossref","unstructured":"Siffer A, Fouque P-A, Termier A, Largou\u00ebt C (2017) Anomaly detection in streams with extreme value theory. In: ACM Knowledge Discovery and Data Mining, pp. 1067\u20131075","DOI":"10.1145\/3097983.3098144"},{"issue":"01","key":"511_CR28","first-page":"101","volume":"37","author":"P Xiong","year":"2014","unstructured":"Xiong P, Zhu T, Wang X (2014) A survey on differential privacy and applications. Chin J Comput 37(01):101\u2013122","journal-title":"Chin J Comput"},{"key":"511_CR29","doi-asserted-by":"publisher","unstructured":"Dwork C, and Roth A (2014) The algorithmic foundations of differential privacy. Found Trends\u00ae Theoretical Comput Sci, 9: 211-407. https:\/\/doi.org\/10.1561\/0400000042","DOI":"10.1561\/0400000042"},{"key":"511_CR30","doi-asserted-by":"crossref","unstructured":"O\u2019neill PE, Entekhabi D, Njoku EG, Kellogg KH (2010) The nasa soil moisture active passive (smap) mission: Overview. In: 2010 IEEE International Geoscience and Remote Sensing Symposium, 3236\u20133239","DOI":"10.1109\/IGARSS.2010.5652291"},{"key":"511_CR31","doi-asserted-by":"crossref","unstructured":"Hundman K, Constantinou V, Laporte C, Colwell I, S\u00f6derstr\u00f6m T (2018) Detecting spacecraft anomalies using lstms and nonparametric dynamic thresholding. In: Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 387\u2013395","DOI":"10.1145\/3219819.3219845"},{"key":"511_CR32","doi-asserted-by":"crossref","unstructured":"Mathur AP, Tippenhauer NO (2016) Swat: a water treatment testbed for research and training on ics security. In: 2016 International Workshop on Cyber-physical Systems for Smart Water Networks (CySWater), 31\u201336","DOI":"10.1109\/CySWater.2016.7469060"},{"key":"511_CR33","doi-asserted-by":"crossref","unstructured":"Su Y, Zhao Y, Niu C, Liu R, Sun W, Pei D (2019) Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2828\u20132837","DOI":"10.1145\/3292500.3330672"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00511-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00511-0","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00511-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T02:03:37Z","timestamp":1782093817000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-025-00511-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,22]]},"references-count":33,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["511"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00511-0","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,22]]},"assertion":[{"value":"23 December 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 November 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 June 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no Conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"89"}}