Detecção de intrusão aplicando random forests em ambiente federated learning

Abstract

The growing expansion of Internet of Things devices has transformed several sectors, driving gains in efficiency and automation. However, this evolution also increases vulnerability to cyber attacks, generating financial risks and damage to reputation. Given this scenario of growing concern about security, effective intrusion detection methods become indispensable. Federated learning emerges as a promising approach to address this challenge, as it enables the training of global models without compromising data privacy. Based on this perspective, this work proposes an intrusion detection method that uses random forests as a classification model, applied to the IoTID20 dataset in a federated environment. The choice of random forests is justified by their robustness in pattern classification, making them suitable for cybersecurity scenarios. To optimize the model’s performance, pre-processing steps were performed on the dataset, providing greater efficiency in training. To mitigate data imbalance, the oversampling technique was applied, contributing to improved results. Additionally, the use of an ensemble for attribute selection allowed the creation of several datasets, enabling the evaluation of model performance in different scenarios. The experiments demonstrated that the federated model performed better than the centralized model, even in the absence of hyperparameter optimization in both models. The federated model achieved average accuracy of 98.51%, F1-score of 98.60%, and Recall of 98.43%, while the centralized model achieved 97.49% accuracy, 97.61% F1-score, and 96.67% Recall, positioning these results competitively in relation to other works in the literature that address intrusion detection in federated environments.