From Centralized Logs to Federated Intelligence: A Computational Systems View of Academic Cybersecurity
Main article
Abstract
Artificial intelligence is reshaping how higher-education institutions protect their networks, endpoints, identities and research data, but the research literature continues to frame the problem as one of model selection rather than of system design. This article takes a different approach. It develops a computational systems view of academic cybersecurity based on a five-layer stack spanning telemetry and sensors, data and features, models and learning, decision and response, and governance and policy, and uses the stack to re-read the systematic corpus of 157 recent studies curated by Agal and Raulji. The analysis produces three findings. First, the field is undergoing an architectural migration from centralized log aggregation toward edge and federated intelligence, but this migration is incomplete and unevenly distributed. Roughly 67 per cent of published studies propose centralized architectures, whereas only about 22 per cent of surveyed universities actually deploy centralized-only systems and roughly 51 per cent use hybrid architectures. Second, performance trade-offs across accuracy, efficiency, practicality, privacy preservation and scalability are structural rather than accidental, because their costs accumulate in different layers of the stack; deep-learning models score lowest in edge practicality (4.3 of 10) despite reaching the highest accuracy. Third, research gaps cluster into reinforcing triangles, notably an adversarial-evaluation-integration triangle and a complexity-maintenance-skills triangle, suggesting that isolated interventions will under-perform. We translate these findings into a concrete research agenda that prioritizes shared federated infrastructure, academically realistic benchmarks, standardized model disclosures, human-in-the-loop integration, governance-as-research and cross-cluster collaboration. The broader argument is that academic cybersecurity is a systems problem in which the weakest coupling between layers — not the best-performing model — determines the quality of the protection that institutions can actually deploy.
