Edge-Cloud Platform for Cybersecurity Data Analysis Leveraging K3s and Federated Learning = Edge Cloud Platform for Cybersecurity Data Analysis Leveraging K3s and Federated Learning

This thesis presents the development of a distributed platform for cybersecurity data collection and analysis, leveraging machine learning (ML) models to detect potential cyberattacks. The platform comprises multiple nodes, which can function as either darknets or honeypots. These nodes capture network data, which is then used to train models using federated learning (FL). Federated learning enables the distributed training of neural networks, achieving results comparable to centralized approaches while preserving data privacy. Each node trains a local model using its own dataset, and only the model weights are shared and aggregated on a central server. The training process is built around the Flower Federated Learning framework. Both the training application and data capture system are packaged in Docker images for the deployment on the K3s cluster-based platform. The platform and remote nodes are configured using Ansible playbooks. Node behavior is defined in configuration files that can be adjusted to activate the desired services, and Helm charts are used to deploy the necessary resources on the nodes based on service requirements. This thesis also presents practical experiments, including image classification and IP packet analysis, demonstrating the platform's versatility and effectiveness. Additionally, it examines the platform's resource usage, considering future scenarios involving edge devices.