# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 6 Analysis of Current IDS Approaches  
In order to conduct a rigorous and methodical analysis of contemporary literature presented in the Section 4, we have applied a thorough criteria with metrics, which are significant for effective intrusion detection for IoT. The individual element of the criteria along with a brief explanation are presented below. The comparative analysis of existing approaches for these criteria is presented in Table 2.  
* **Placement:** As with the contemporary computing systems, the placement of an intrusion detection system is crucial as it determines the level of visibility it can offer to the activities within the monitored system. For instance, a network-based IDS is limited to monitoring the network traffic originated or destined for the monitored host and, therefore, cannot monitor any process subversion or privilege escalation within the monitored host. This is increasingly important for IoT systems with recent studies highlighting the lack of protection for IoT devices [74]. Furthermore, our analysis of existing intrusion detection approaches for IoT highlights that majority of these approaches are network-based, which restricts the depth of events visible to such systems. In view of emerging malware, such as Botnets, visibility of system-level events, including system calls is important to protect against such threats. * **Detection time frame:** One of the important characteristic of IoT systems is the dynamic nature of the system with the participating nodes following an adhoc pattern. Therefore, the time-frame of detection becomes even more important with the objective to detect an attack as soon as possible to avoid spreading infection to wider devices. Through analysis of existing literature, we have identified that majority of existing approaches are established and evaluated within isolated environments which has two-fold impact; (i) the implementation and evaluation does not accurately represent an IoT environment, and (ii) experimentation results conducted in isolated, simulated environment, such as Matlab or Contiki do not accurately simulate the challenges encountered within a real-world IoT environment. Therefore, majority of existing approaches are limited to offline detection which inhibits an IDS's ability to protect against malicious threats in timely manner. * **Detection Engine:** An IDS can utilize a variety of detection engines, such as anomaly, signature and game based as highlighted in Section 4. The choice of detection engine has two-fold impact i.e., (i) it can affect the ability of an IDS to detect attacks, and (ii) it impacts the performance overhead incurred by the engine. For instance, although signature-based IDS have been identified to be resource efficient, they do not have the ability to detect zero-day attacks. Analysis of literature presented in Section 4 and summarized in Table 2 highlights that although existing approaches use a variety of techniques, however, it also identifies an increase in the use of artificial intelligence and deep learning to achieve effective intrusion detection. In view of the extraordinary increase in volume and variety of attacks for IoT systems, these developments highlight future trends and require further advancements to fulfil the potential of these technological advancements. * **Architecture:** The system architecture of an IDS specifies how the detection system carried out its detection functions. The system architecture not only affects the detection accuracy and performance but also affects user privacy. The standalone detection system mainly operates at the local machine or the device thereby susceptible to extended detection time because of the non-availability of enough data and stealthy nature of the attacker. However, a collaborative architecture utilizes data from different sources, such as IoT devices or network devices within the same or different organization. It can improve the detection accuracy, however, it introduces the challenge of privacy of the data shared between the entities.