# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 7 Open Challenges and Future Directions  
As part of this research, we have performed a thorough review of existing efforts to address one of the critical aspects of IoT security i.e., intrusion detection. In previous sections, we have presented a comprehensive account of the state-of-the-art within this domain and a thorough comparative analysis of individual approaches. In this section, we highlight important future research directions which require further investigation and efforts to improve overall security of an IoT system. 1. **Constrained resources:** A typical IoT device has limited resources such as constrained processing power, low storage capacity, and limited battery power. Within this context, resource-hungry intrusion detection system would drain the resources of an IoT system. Therefore, it is important to have a Intrusion detection system that fulfills two important characteristics: (1) any IDS should not incur significant computational and communication overhead, and (2) an IDS should achieve high detection accuracy. In particular, the use of anomaly-based detection systems [47; 48; 49] requires considerably higher resources than the signature-based detection systems while having a trade-off between detection accuracy and overheads. For instance, anomaly detection is particularly effective against previously unknown attacks, but is expected to incur a significant performance overhead. As an attempt to explore opportunities within this context, we have formulated a collaborative intrusion detection system in [66], which aims to use both anomaly- and signature-based detection engines to achieve performance efficiency without compromising detection accuracy. Our analysis has revealed that many of the existing systems have not been designed for resource-constrained devices, however these approaches mainly focused on increasing the detection accuracy with small false positive. We believe there should be trade-off among three important factors (1) high detection accuracy, (2) performance overheads, and (3) privacy-preservation. Furthermore, dedicated efforts are required to devise approaches considering resource constraints that primarily focus on the energy consumption agnostic of resources and memory consumption. 2. **Multi-stage attacks:** A typical intrusion is carried out over multiple stage, each attempting to exploit a specific vulnerability. Such sophisticated attacks are termed as _multi-stage attacks_, and are common mechanisms for traditional and emerging computing systems such as IoT. Although such threats have been investigated in other domains such as mobile, existing detection systems for IoT solely focus on the detection of individual threats agnostic of potential relationships between them. We believe the dynamic nature of the IoT systems makes the challenge of multi-stage attack detection non-trivial requiring explicit efforts to address it. [PERSON] and Chi [20] represent one of the initial effort which recognize and explicitly seek to detect relationships between different malicious incidents. However, it represents a limited effort and further work is required to address detection and protection against multi-stage attacks within the IoT systems. 3. **Device protection:** As identified by [74], one of core issues with respect to the security of IoT systems is the security of the device as _\"it is often neglected by the manufacturers and usually an afterthought\"_. The lack of protection at device level within such systems has resulted in significant security attacks such as Mirai botnet in 2016 [37] and its more recent versions, such as Brickerbot [75] and Reaper [76]. In order to protect against such threats device-level security measures are paramount which can protect IoT systems. One such measure can be an effective intrusion detection installed within the IoT device.