[en] Intrusion detection refers to methods for determining whether a computer system or network has been compromised or is currently under attack. Multiple types of intrusion detection systems exist according to the technologies used for threat detection and the environment or devices in which it is intended to be deployed. This thesis is framed in the context of machine learning (ML) techniques applied to intrusion detection in Internet of Things (IoT) settings. This is a timely line of research as, despite the benefits and pervasiveness of IoT, several vulnerabilities and poor security practices have led to malware specifically designed to target and exploit the IoT ecosystem. In particular, in this thesis, we explore federated learning (FL) approaches, a relatively new ML training framework especially suitable for distributed settings such as IoT. In short, FL is a ML training paradigm with the objective of training a model between multiple collaborating clients while maintaining the training dataset local and private to each device, thereby addressing challenges such as data privacy, availability and communication cost concerns that arise in traditional cloud or edge ML model training methods. While FL has been successfully applied to many practical settings, including next-word prediction for mobile keyboards or voice classification, to name a few, the application of these settings to IoT security has not been as widely researched. Moreover, this setting presents significant gaps and challenges that have served as motivation for this thesis, including the scarcity of public IoT security datasets for ML training purposes specifically designed for FL experimentation, the cost of data labeling, the high heterogeneity of IoT deployments that can hinder FL model training convergence and the need for explainability to address the black-box nature of many ML models, which is crucial to increase the trust of these techniques by security analysts but presents additional issues in FL settings. While those are not the only challenges, this thesis presents three main contributions towards reducing the mentioned gaps. First, we develop an emulated testbed to generate datasets in a reproducible, extendable and shareable way specifically designed to allow FL experimentation. The testbed presents many threat models, including real malware samples. Then, we present a FL architecture for unsupervised network anomaly detection that addresses the high heterogeneity of IoT deployments by using an automatic client clustering technique integrated into the FL process. Finally, we propose a methodology to incorporate an explainability layer on top of the unsupervised anomaly detection models that uses FL techniques to characterize, group, summarize and auto-label the detected anomalies throughout the federated network.

[eu] Intrusioen detekzioak sistema edo sare informatiko batek baimenik gabeko sarbideak izan dituen edo erasopean dagoen bermatzeko metodoak garatzea du helburu. Teknologia aurreratu ahala, hainbat intrusio detekzio sistema mota ezberdin sortu dira mehatxuak antzemateko erabiltzen den teknologiaren arabera edo babestu nahi diren gailuen edo inguruaren arabera. Tesi hau machine learning (ML) tekniketan oinarrituta dauden intrusio detekzio sistemak Gauzen Internet (IoT, Internet of Things) ingurua babesteko arloaren barruan kokatzen da. Hain zuzen ere, IoTaren abantailak eta erabilera handia izan arren, hainbat segurtasun ahultasunen eta praktika txarren ondorioz, IoT gailuen aurkako hainbat malware ugaritu dira. Zehazki, tesi honetan federated learning (FL) teknikak aztertu ditugu, ML modeloak entrenatzeko teknika berri bat sistema banatuetarako bereziki egokitua, hala nola IoT ingurunerako. Laburki, FL-en helburua ML modelo bat kolaboratiboki entrenatzea da hainbat gailuren (bezeroak FL prozesuan) artean. FL-en bereizgarritasun nagusiena entrenatzeko datu guztiak lokalki bezero bakoitzean mantentzen direla da, horri esker, beste ohiko tekniketan (hodeiko edo perimetroko konputazioan) sortzen diren datuen pribatutuasun, eskuragarritasun eta komunikazio kostuen erronkei aurre egin ahal zaie FL-ari esker. Nahiz eta FL-ek arrakasta ona izan hainbat kasu praktikoetan, esate baterako mugikorren teklatuetan hurrengo hitzak aurresateko edo ahotsaren azterketarako, IoT inguruan intrusio detekziorako ez da hain sakonki ikertu. Halaber, arlo honek dituen hainbat erronka eta hutsuneak tesi honetarako motibazio gisa erabili ditugu; besteak beste, FL esperimentuetarako egokiak diren IoT segurtasun datu publikoen falta, datuen etiketatzearen kostua, IoT ingurunearen heterogeneotasun handia dela eta sortutako arazoak FL-ko modeloen entrenamenduan eta FL inguruan entrenatutako ML modeloei azalgarritasuna emateko beharra. Azken puntu hau funtsezkoa da segurtasun analistek ML tekniketan konfiantza hobetzeko. Aipatutako erronkak arlo honetako bakarrak izan ez arren, tesi honetan horiek izan dira bereziki landu ditugunak. Bertatik, hiru ekarpen nagusi aurkeztu ditugu. Lehenik, saiakuntza-banku emulatu bat aurkezten dugu IoT segurtasun datu-multzoak sortzeko eta FL-ekin esperimentatzeko modu erreproduzible, moldagarri eta erraz banatzeko moduan. Saiakuntza-bankuak hainbat mehatxuaktore emulatzen ditu malware errealak erabiliz. Ondoren, FL arkitektura bat aurkezten dugu anomalien detekziorako gainbegiratu-gabeko modeloak entrenatzeko. IoT ingurunearen heterogeneotasun handiak eragindako arazoei aurre egiteko, FL prozesuan integratutako bezeroen taldekatzeko algoritmo bat proposatzen dugu. Azkenik, aldez aurretik entrenatutako anomalia detekziorako modeloei azalgarritasuna aurkezteko metodologia bat proposatzen dugu. Horretarako, FL teknikak ere erabiltzen ditugu federatutako sareko bezero guztietan antzemandako anomaliak automatikoki deskribatzeko, taldekatzeko, laburtzeko eta auto-etiketatzeko.