# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 4 State-of-the-Art in IDS for IoT
### Hybrid Approaches to Intrusion Detection  
In addition to the approaches discussed earlier, current literature in this domain also includes efforts which combine multiple different approaches to achieve effective detection. In this respect, [PERSON] et al. [13] proposed a self-adapting, Knowledge-driven Expert Intrusion Detection System (KALIS) which can improve its performance after evaluating its efficiency. It is focused on network features and its protocols to improve detection efficiency. KALIS automatically collects the information about the features and configures most suitable detection technique. All the KALIS components run independently with support for a wide variety of mediums and related protocols. The attacks considered by KALIS are variants of DoS attacks i.e., ICMP Flood and SMURF which produce similar symptoms i.e., high amount of ICMP Echo Reply Messages directed to affect the machine.  
[PERSON] et al. [65] proposed a hybrid approach for intrusion detection within IoT, which combines signature and anomaly-based techniques to achieve effective detection. The authors adopt a game theoretic approach based on Nash Equilibrium (NE) to determine the equilibrium state in which the IDS agent will activate its anomaly detection technique to train, classify and build a rule related to a new attack's signature. Furthermore, with respect to placement of IDS, both the signature and anomaly-based detection systems are based on individual IoT devices. The authors explain this decision to be motivated by the objective to reduce the communication overhead based on the assumption that the communication overhead is more resource-hungry as compared to computational overhead. However, this is expected to have significant computational overhead in the case of zero day attacks. Furthermore, the proposed system is limited in its visibility to the events occurring on the individual nodes and therefore limits its ability to effectively detect of sophisticated attacks which may be composed of multiple steps.  
[PERSON] et al. [15] proposed Svelte which is a lightweight hybrid intrusion detection system focused on Routing attacks, such as Spoofing, Sinkhole and Selective Forwarding. Svelte has three main modules i.e., 6 LoWPAN Mapper (6 mapper), Intrusion Detection component and Distributed Mini Firewall. Although Svelte presents a hybrid approach, however, there are considerations that should be taken into account. For instance, although anomaly-based intrusion detection systems have the advantage of better detection accuracy for zero-day attacks, they are typically resource-hungry which can be a bottleneck when implementing them on resource constrained IoT devices. Furthermore, known attacks such as Rank attack, Sinkhole and spoofing are well established leading to an established signature for their detection. However, attacks such as multi-stage or zero-day require analysis from a wider perspective, analyzing behavioral and usage patterns which makes a case for using anomaly-based IDS. Therefore, an IDS for IoT should take these factors into consideration when making choices, such as the type of IDS, placement and the visibility of the data.  
[PERSON] et al. [66] present a recent effort to address intrusion detection for IoT systems particularly focusing at the constrained resources available at the IoT devices. The authors presented a collaborative approach where IDS modules are implemented at both device and edge-router level to improve visibility, detection rate and to reduce false positives. The authors propose signature-based IDS at the node level due to its performance efficiency and anomaly-based detection at the edge-router to enhance the detection accuracy. The approach is novel in that it proposes a innovative solution to achieve high detection accuracy whilst taking into account the limited resources available at the sensor devices.