# A Lightweight Perceptron-Based Intrusion Detection System for Fog Computing
## 2 Related Work
### Work in IoT Security  
Decision Trees (DT) can be considered as a main classifier or collaborative classifier along with other ML classifiers in security applications, such as intrusion detection [16; 17]. DT is proven to be an easy and simple technique, given that only few DTs are involved simultaneously, due to the constraint of large storage requirement by DTs. Moreover, DTs can provide adequate levels of transparency. An example of a DT application can be found from a previous study, proposing the use of a fog-based security system for IoT devices [18]. The research used DT to analyze network traffic to detect suspicious traffic sources and consequently detect intrusions. Further into the IoT environment, a study [19] managed to develop an Android malware detection system, aiming to secure IoT systems using a linear Support Vector Machine (SVM). The detection performance of SVM was compared to Naive Bayes (NB), Random Forest (RF), and DT. The outcomes of the comparison showed SVMs clearly outperformed the other ML algorithms. These results confirmed the robust nature and application of SVM for malware detection purposes. Such performance is expected from SVMs as it can deal with large number of attribute features using only few sample points. Moreover, further research is needed to understand the performance of SVMs with enriched datasets, as well as datasets which are created with various attack scenarios and environments. Nevertheless, it would be of a great interest to compare the performances of SVM with those of Deep Learning (DL) algorithms, such as convolutional neural network (CNN) algorithms. This is due to the difficulty of understanding and interpreting SVM-based models, since deciding on the optimal kernel is a complicated task. A previous study focused on using SVM to secure a smart grid [20]. This research showed that the ML algorithms SVM, KNN, MLP, ensemble learning and sparse logistic regression are effective in detecting known and unknown attacks, performing better than traditional methods used for attack detection in smart grids. A study [21] suggested a model for the detection of U2R and R2L attacks. The models aimed to reduce the dimensionality of the features to enhance efficiency. The model used two layers of feature reduction and then applied a two-tier classification model that uses NB and KNN classifiers. The results of the model showed good detection results for both attacks. [PERSON] et al. [22] studied the implementation of ML algorithms for the purpose of precise IoT device identification, by utilizing network traffic features, which are then embedded into a multi-stage classifier. The classifier managed to categorize the devices that are connected to the network as IoT or non-IoT devices; the ML algorithms identified unauthorized links of IoT devices automatically and accordingly lessened the disruptions that may occur due to threats. In a previous study [23], the abnormal behavior of IoT devices were profiled and the generated dataset from profiling was used to train the classifier to detect abnormal behavior. With the assumption that attackers can utilize changes for malicious purposes, the author investigated how a partial variation of sensed data can influence the accuracy of the learning algorithm. The author used SVM and K-means clustering as experimental cases for examining the impact of such changes on the detection accuracy of both ML algorithms. The outcomes showed that both algorithms suffered from low detection accuracy. The zero-day attacks are mostly variations of existing attacks; hence, the accuracy of the classifier in detecting variations and changes in the dataset can be a research topic for future investigation. In [24], the authors suggested the adaptation of a framework to recognize all potential attack paths and alleviate the effects of attacks on the IoT system.