Detecção de intrusão em dispositivos de Internet das coisas com uma abordagem de aprendizado federado

• Main Author: Ribera, Carlos Dimitri Ramirez
• Publication Date: 2024
• Format: Master thesis
• Language: por
• Source: Biblioteca Digital de Teses e Dissertações do UNIOESTE
• Download full: https://tede.unioeste.br/handle/tede/7452
• topic: Inteligência Computacional; Mineração de Dados; Segurança Computacional; IoTID20; Aprendizado de Máquina; Inteligência Artificial; Computational Intelligence; Data Mining; Computer Security; IoTID20; Machine Learning; Artificial Intelligence; Federated Learning; Independently and Identically Distributed; Non-Independently and Identically Distributed; CIENCIA DA COMPUTACAO::SISTEMAS DE COMPUTACAO

Several human activities are automated by technological means capable of generating, processing, and storing data. This context is driven by the Internet and its subsequent phase known as the Internet of Things, enabling data traffic and connection among different types of devices in a distributed manner. Computational systems have vulnerabilities that can be exploited by malicious users, leading to attacks. Given this scenario, computer security has become a focus of study in the literature, emphasizing intrusion prevention and detection systems that create barriers against threats. These systems employ various techniques for attack detection, commonly leveraging machine learning algorithms such as artificial neural networks. In addition to the traditional approach of training artificial neural networks for security in a centralized manner, a new approach known as Federated Learning has been studied in the literature and implemented in systems. In light of this, the present work aims to compare Federated Learning with the traditional approach by constructing models of artificial neural networks and subsequently evaluating their performance using accuracy and recall metrics. The experiment applied the IoTID20 public security event dataset for intrusion detection, considering a binary classification task. Different data distributions among clients in the proposed architecture were also considered to evaluate scenarios of Independently and Identically Distributed and Non-Independently and Identically Distributed data. The results indicate that both studied approaches exhibit equivalent performance when the clients in the architecture have IID data and similar amounts of records. Furthermore, the Federated Learning approach can outperform the centralized approach when the chosen aggregation algorithm is Federated Average and the client with the most records has a data distribution favorable for the classification task.