# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 6 Analysis of Current IDS Approaches
Furthermore, with regards to detection accuracy and performance, a typical IoT system is comprised of a number of IoT devices arranged into a local network such as a LoWPAN and an edge router which manages communication between local network and the Internet. Within this context, existing approaches can be categorized based on the location of the IDS module with distributed referring to IDS module implemented on IoT devices and centralized referring to IDS module implemented at the edge router. In this context, analysis of literature highlights emergence of schemes, whichtake into account distributed nature of a typical IoT architecture through collaboration between IoT devices and edge routers [16; 35]. We believe collaborative approaches can be beneficial in protecting against large-scale attacks, however, further work is required to enhance existing efforts to achieve effective and timely detection. * **Performance Overhead:** A typical IoT device is constrained with respect to resources available for compute-hungry processes, such as intrusion detection. Therefore, we believe performance overhead caused by an IDS is one of the important criterion and can be measured in the form of energy consumption or CPU usage by the IDS. Our study of literature has highlighted that majority of existing approaches do not take into account performance overhead whilst evaluation effectiveness of these approaches. We believe, due to the resource-constrained nature of IoT devices, this is an important criteria to assess effectiveness of an IDS for IoT, and therefore, identifies a gap in literature which requires further efforts by the research community. * **Attack types:** We have presented a comprehensive discussion about the potential attacks within an IoT system supported by an attack model. These different types of attacks can be detected at different levels (network or host) and using different approaches, such as anomaly and signature-based. Furthermore, review of literature has also highlighted emergence of novel attack types, such as Botnets, which exploit specific vulnerabilities within a typical IoT system, and therefore, require further efforts to achieve effective protection mechanisms. * **Detection Performance:** Detection performance represents the rate of with which an IDS can successfully detect a malicious attempt. It is one of the fundamental attributes of an IDS as it can be directly aligned to its effectiveness. Analysis of existing approaches summarized in Table 2 highlights that majority of these approaches report high detection performance in terms of detection accuracy, FPR and TPR. However, as highlighted earlier, a significant number of current efforts are implemented and evaluated in isolated environment which do not accurately reflect a real-world IoT environment and therefore require further efforts to address this limitation. * **Scalability:** Typically, the number of devices within an IoT system is significantly higher compared with contemporary systems. In order to address the significant number of devices involved, the scalability of the IDS is an important criterion. As highlighted in Table 2, a number of existing efforts have adopted a centralized approach which affects scalability of such efforts and therefore require further work to address this limitation.