Classificação hierárquica aplicada a sistemas de detecção de intrusões em redes IoT

Abstract

The evolution of Information and Communication Technologies has brought both benefits and risks, especially with the emergence of the Internet of Things (IoT), which has increased vulnerability to cyberattacks. In this context, Intrusion Detection Systems (IDS), which employ machine learning techniques to classify malicious traffic, are essential for identifying attacks in IoT networks. However, traditional flat classifiers, whether binary or multiclass, present limitations in the trade-off between high sensitivity in intrusion filtering and granularity in the identification of attack types. In light of this, this study proposed and investigated hierarchical classifiers for intrusion detection in IoT networks, aiming to combine the high sensitivity of binary classification with the attack discrimination capability provided by multiclass classification. Using the CICIoT2023 dataset, two hierarchical models were constructed and evaluated: Benign–DDoS–Multiattack (BDM) and Benign–Recon–DDoS–Multiattack (BRDM). The hierarchical classifiers successfully combined the strengths of both flat classification approaches, with the BRDM model enhancing detection performance by introducing a specific level for Recon attacks, thereby reducing prediction errors and outperforming the multiclass model in detecting classes such as Spoofing, Brute Force, and Web-Based attacks. This research concludes that hierarchical classification is a promising approach for IDS in IoT networks, as it overcomes the limitations of flat classifiers and contributes to improved interpretability and robustness of the systems.