# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 4 State-of-the-Art in IDS for IoT
### Specification-Based Approaches to Intrusion Detection  
[PERSON] et al. [58] propose an IDS for Internet of Vehicles (IoV) i.e., an open and integrated network system connecting human intelligence, vehicles, things, environments and the Internet. Authors explain fundamental requirements for an IDS for IoV i.e., host protection via detection, constrained resources, and real-time detection. Through our research, we have identified these characteristics to be shared by a typical IoT system. Due to these requirements, conventional IDS is not feasible for IoT as it incurs significant overhead with respect to required resources and processing time. [PERSON] and [PERSON] [20] proposed a Complex Event Processing (CEP)-based approach to intrusion detection for IoT is proposed with the aim to provide low latency and real time processing of security events. Although the use of CEP for intrusion detection is not novel, it is rather innovative concept within intrusion detection for IoT and this work can be considered as a means to assess the feasibility of CEP within IoT. The proposed system is developed as a rule-based IDS which collects network traffic data from the edge router, extracts events from this data and performs intrusion detection. Although the discussion of the approach is not detailed, we believe CEP can be explored further to address sophisticated or coordinated attacks within IoT which are a combination of simple attack steps. [PERSON] et al. [59] present a network-based intrusion detection system for Internet-connected WSNs which share close similarities with a typical IoT network. The authors adopted a distributed approach to their design in that the IDS is deployed as a module on randomly selected devices called _watchdogs_ over a WSN, reporting to a centralised Event Management System (EMS). Although the IDS module is deployed on individual devices, it only monitors network traffic visible at the node. However, as the watchdogs devices are heterogeneous in location and function, this may have an impact on the types of threats encountered at a specific device. Therefore, each watchdog device is pre-configured with custom monitoring rules, which are designed to detect specific threats expected to be encountered by a device. We believe that the distributed approach adopted by the authors is symmetric with the inherent characteristics of a typical IoT network, however, the role of EMS is limited to information collection limiting its ability to monitor the overall state of a network and to detect coordinated attacks. [PERSON] et al. [60] presented one of the early efforts to establish an IDS for IoT where authors proposed a host-based IDS for LoWPANs using Contiki OS and 6 LowPAN [61; 62]. The proposed IDS is able to perform detection based on the information at the node-level which is transmitted to a centralized system for further analysis. The proposed system limits detection to events monitored at the individual devices and does not demonstrate effective detection under DDoS attacks, which not only overwhelm the device but also congest the communication channel between nodes and the centralized system. [PERSON] et al. [63] is one of the recent attempts to achieve intrusion detection for IoT where authors present an interesting approach which is similar to COILDE project [16; 35] in that both advocate collaboration between sensor and edge devices to achieve effective intrusion detection. Authors have presented details of their implementation of the host component, which performs behavioral analysis to identify malicious attempts represented by the system calls executed by processes within a device. Although authors recognize the significance of performance costs for IoT devices, the evaluation reports performance in terms of computational costs, which does not provide in-depth insight into the performance efficiency of the proposed scheme. [PERSON] et al. [64] has proposed a specification-based approach for IoT intrusion detection aiming to protect against zero-day attacks.