Avaliação do desempenho de técnicas de aprendizado de máquina na detecção de malware em tráfego de Redes IoT

Abstract

Given the exponential increase in Internet-connected devices and the consequent expansion of the attack surface, the security of these devices becomes a critical issue. In this context, the IoT-23 dataset, which contains network traffic records captured from Internet of Things (IoT) devices, both benign and malware-infected, is utilized to create classification models capable of detecting infected flows. The development involves cleaning and transforming the data, including normalization and the selection of relevant attributes, to prepare the dataset for the application of classification algorithms. The analyzed algorithms include Decision Tree, Random Forest, Extra Trees, K-Nearest Neighbors (KNN), and Gaussian Naive Bayes. Each algorithm was implemented and tested using the k-fold cross-validation technique, which allows for the evaluation of the models’ generalization capabilities. The results were measured in terms of accuracy, execution time, and the number of errors, providing a clear view of each technique’s performance. The study discusses the effectiveness of machine learning approaches in malware detection, highlighting that the Decision Tree technique shows the best results according to the established metrics. Additionally, the analysis discusses the relevance of data transformations and segmentations, considering their impact on the classifiers’ performance. The results obtained can guide the development of more efficient and robust intrusion detection systems capable of protecting IoT devices against attacks. The research contributes to the field of IoT security and machine learning, proposing future directions for the implementation of AI-based security solutions.