Privacy-Aware Guarded Federated Scorebank Ensembles: Software and Reproducibility Package
Abstract
This record provides the version 1.0.0 software and reproducibility package supporting the manuscript Privacy-Aware Guarded Federated Scorebank Ensembles for Unsupervised Edge Insider-Threat Detection. The implementation studies heterogeneous cross-silo collaboration using three CMU CERT release-based clients. It includes a benign-only local anomaly scorebank, adaptive rank-and-severity calibration, personalized federated representation learning, a label-free client-side admission guard with abstention, a separately evaluated support-scarcity route, and differentially private mechanisms for collaborative neural updates and bounded aggregate histograms. Package contents Four ordered Jupyter notebooks covering cache construction, independent local clients, guarded federation, and privacy-utility evaluation. Reusable Python implementations and command-line experiment entry points. Locked aggregate metrics, ablation tables, communication and runtime measurements, validation records, environment reports, and publication figures. Machine-readable citation metadata, licenses, checksums, and a file manifest. Data and privacy boundary The raw CMU CERT releases and generated session cache are not redistributed. Users must obtain CMU CERT r4.2, r5.2, and r6.2 from the official KiltHub record and rebuild the cache. The included data/insiders.csv is a compact derivative of the public answer keys, carries explicit attribution, and includes the documented r6.2 scenario-4 timestamp repair. The reported privacy values account for DP-SGD and bounded-histogram mechanisms at a fixed transformed user-profile matrix. Data-dependent feature selection and robust scaling precede the accountant, and local alert outputs are outside its scope. The release therefore does not claim end-to-end user-level differential privacy from raw event logs. Reproducibility Saved results are separated from executable source. Serialized model objects, raw user-profile matrices, and individual prediction files are excluded; they are regenerated by the supplied workflows. The retained manifests identify the runs, seeds, configurations, and software environments used for the reported evidence. Dataset reference: Brian Lindauer, Insider Threat Test Dataset, KiltHub, version 1, DOI: 10.1184/R1/12841247.v1.
