Detecção de intrusão aplicando random forests em ambiente federated learning

• Ano de defesa: 2025
• Autor(a) principal: Costa, Marcio Fernandes da
• Orientador(a): Machado, Renato Bobsin
• Banca de defesa: Maciel, Joylan Nunes , Zalewski, Willian
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: por
• Instituição de defesa: Universidade Estadual do Oeste do Paraná; Foz do Iguaçu
• Programa de Pós-Graduação: Programa de Pós-Graduação em Engenharia Elétrica e Computação
• Departamento: Centro de Engenharias e Ciências Exatas
• País: Brasil
• Palavras-chave em Português: Aprendizado federado; Dispositivos iot; Detecção de Intrusão; Florestas aleatórias
• Palavras-chave em Inglês: Federated learning; IoT devices; Intrusion detection; Random forests
• Área do conhecimento CNPq: CIENCIA DA COMPUTACAO::SISTEMAS DE COMPUTACAO
• Link de acesso: https://tede.unioeste.br/handle/tede/8042

The growing expansion of Internet of Things devices has transformed several sectors, driving gains in efficiency and automation. However, this evolution also increases vulnerability to cyber attacks, generating financial risks and damage to reputation. Given this scenario of growing concern about security, effective intrusion detection methods become indispensable. Federated learning emerges as a promising approach to address this challenge, as it enables the training of global models without compromising data privacy. Based on this perspective, this work proposes an intrusion detection method that uses random forests as a classification model, applied to the IoTID20 dataset in a federated environment. The choice of random forests is justified by their robustness in pattern classification, making them suitable for cybersecurity scenarios. To optimize the model’s performance, pre-processing steps were performed on the dataset, providing greater efficiency in training. To mitigate data imbalance, the oversampling technique was applied, contributing to improved results. Additionally, the use of an ensemble for attribute selection allowed the creation of several datasets, enabling the evaluation of model performance in different scenarios. The experiments demonstrated that the federated model performed better than the centralized model, even in the absence of hyperparameter optimization in both models. The federated model achieved average accuracy of 98.51%, F1-score of 98.60%, and Recall of 98.43%, while the centralized model achieved 97.49% accuracy, 97.61% F1-score, and 96.67% Recall, positioning these results competitively in relation to other works in the literature that address intrusion detection in federated environments.