Abstract Phishing email attacks have evolved into a significant threat, causing substantial economic and political harm. However, existing detection methods often neglect the data heterogeneity resulting from diverse email sources and are trained on balanced email datasets, which do not accurately reflect real-world scenarios. Meanwhile, with increasing privacy protection regulations, it is crucial to develop methods that enhance phishing email detection capabilities while preserving user privacy. To address these challenges, we propose PhFL, a framework based on heterogeneous federated learning, for detecting phishing emails. PhFL decouples clients’ models into representation learning models and classifiers. The representation learning models can be tailored to clients’ specific needs, and the classifiers are globally shared and re-trained on the server, leveraging the class feature means generated by the representation learning models. Our framework allows each client to leverage its private data locally without providing emails to other clients or the server. The collaboration of class feature means and re-training of classifiers effectively address the challenges of class imbalance and data heterogeneity, enabling improved model performance. Experimental results demonstrate that PhFL outperforms other federated learning methods, particularly when different clients have email datasets from diverse sources and face imbalanced class distributions.

Microservice systems, characterized by their distributed nature and dynamic environments, pose significant challenges for failure diagnosis. Traditional failure diagnosis methods based on a single source of observability data, such as logs, metrics, or traces, fall short due to their inability to manage the complexity of inter-service communications. Consequently, in recent years, many methods based on multi-source observability data have been proposed, which promise a comprehensive analysis by integrating logs, metrics, traces. However, despite the promising potential of multi-source methods, we find that existing works often overlook a critical question: whether multi-source data is truly necessary for failure diagnosis. To address this, we conduct a systematic evaluation of eleven representative failure diagnosis methods based on multi-source observability data, using three public datasets and our own curated dataset. Our experiments focus on multiple aspects of multi-source datasets and methods. The results indicate that the quality of existing open-source datasets is inconsistent, and not all studied methods consistently perform well. Surprisingly, we find that adding more data sources does not necessarily improve the performance of microservice failure diagnosis in some cases.

Microservice systems are inherently complex and prone to failures, which can significantly impact user experience. Existing diagnostic approaches based on single-modal data such as logs, metrics, or traces cannot comprehensively capture failure patterns. For those multimodal data-based failure diagnosis methods, the dominant modality can overshadow others, hindering low-yield modalities from fully leveraging their characteristics. This paper proposes Medicine, a modal-independent microservice failure diagnosis framework based on multimodal adaptive optimization. It encodes different modalities separately to retain their unique features and employs adaptive optimization to adjust the learning pace between modalities, thereby enhancing overall diagnostic performance. Experimental results demonstrate that Medicine outperforms existing single-modal and multimodal diagnostic approaches on three public datasets, with F1-score improving by 15.72% to 70.84%. Even in cases where individual modal data is missing or of lower quality, Medicine maintains high diagnostic accuracy.