DSSN-V4: An Integrated Framework for Unified Security Event Modeling, Risk Assessment, Threat Propagation, and Federated Learning in Heterogeneous Environments

Abstract

Modern computing environments integrate Linux servers, Windows workstations, and Android devices, creating fragmented security telemetry that limits the detection of coordinated cross-platform attacks. This paper proposes DSSN-V4, a unified distributed framework for cross-platform threat monitoring and global risk assessment. The framework collects platform-specific events through eBPF on Linux, Event Tracing for Windows (ETW), and Binder IPC monitoring on Android, then transforms them into a Unified Security Event Model. It combines multidimensional local risk, shared global risk, threat-propagation probability, and a federated learning classifier within a single decision score. A reproducible Python-based simulation was conducted using 7,200 training events, 1,800 validation events, and 3,000 test events, including 200 synthetic three-stage Android-Linux-Windows attack campaigns. Experimental results showed that the unified model achieved 96.50% accuracy, 98.11% precision, 91.97% recall, a 94.94% F1-score, and a 0.98% false-positive rate. Compared with a local-risk-only baseline, the proposed framework improved the F1-score by 1.44 percentage points, reduced the false-positive rate by 0.41 percentage points, and increased complete campaign recall from 72.0% to 77.5%. These findings indicate that normalized cross-platform evidence, explicit risk propagation, and federated intelligence can operate as one coherent and auditable security pipeline. However, the evaluation uses synthetic data and does not establish production endpoint performance, privacy guarantees, instrumentation overhead, or blockchain throughput. real-world DSSN-V4 therefore represents a testable proof-of-concept that requires future validation using eBPF, ETW, and Binder telemetry.