Sistemas de detecção de intrusão baseado em deep learning para ambientes de internet das coisas

Abstract

The expansion of the Internet of Things (IoT) has introduced significant network vulnerabilities, rendering traditional Intrusion Detection Systems (IDS) inadequate and highlighting the need for smarter solutions. Although deep learning (DL) shows high efficacy, its "black-box" nature creates distrust, and its implementation in loT devices is hindered by memory and processing constraints. This work aimed to develop and comparatively evaluate four DL architectures (CNN, LSTM, GRU, and CNN-LSTM) for a Network Intrusion Detection System (NIDS), with a central focus on explainable Al (XAI) and the analysis of the trade-off between detection efficacy and computational efficiency. The methodology employed a rigorous two-phase process, using a public NIDS dataset, which underwent pre-processing, normalization (MinMaxScaler), and a hybrid balancing strategy. K-Fold Cross-Validation was applied to ensure model stability with normalization and balancing performed within each fold to prevent data leakage-followed by a final evaluation on a 15% hold-out test set. The results demonstrated that while all models achieved efficacy metrics exceeding 99.9%, the hybrid CNN-LSTM model obtained the highest F1-Score and ROC AUC. However, qualitative analysis revealed that the GRU model was superior in minimizing False Positives. The efficiency analysis, crucial for the loT scenario, exposed a complex trade-off: the CNN was the fastest in inference (34.02s) but the heaviest in memory (3.62 MB), whereas the GRU was the lightest (0.46 MB) but 3.4 times slower (116.14s). The comparative XAI analysis with SHAP validated the models' transparency, showing that the GRU and LSTM converged on a robust "reasoning." It is concluded that the GRU model represents the best compromise for loT deployment, as its memory efficiency (0.46 MB) and superior efficacy in reducing False Positives are more critical than its inference latency, which can be mitigated in future work through optimizations such as quantization and pruning.