# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 4 State-of-the-Art in IDS for IoT
### Anomaly-Based Approaches to Intrusion Detection  
With the notable advancements within the domains of artificial intelligence, machine learning and deep learning, anomaly-based approaches have been increasingly used for intrusion detection in general and for IoT in particular. [PERSON] et al. [42] proposed a host-based IDS using Software Defined Technology (SDN) for smart homes. The authors have defined three basic requirements for an efficient IDS for IoT i.e., unobtrusive approach, negligible overheads, and scalability. The proposed approach uses sensors to host the intrusion detection module, which is envisioned to monitor network traffic visible at an IoT device. The detection can be performed using a choice of detection modules i.e., signature, anomaly or specification-based techniques. The authors claim that hosting the intrusion detection module within an IoT device reduces the communication overhead, however, it increases the processing overhead at the IoT device, which is critical for such low powered devices. [PERSON] and [PERSON] [43] proposed an anomaly-based IDS aiming to reduce false alarm rates and increase detection efficiency using data mining techniques. The proposed system aims to monitor network traffic and uses techniques, such as K-NN, K-Means and Decision Table Majority Rule-based scheme focusing on U2R, R2R,DoS and Probe attacks. The authors have used a KDD 99 dataset to evaluate the effectiveness of the approach, which highlights the unavailability of security events data from an IoT system to aid more rigorous and proportionate evaluation of IDS systems for IoT. Figure 2: Categorization of IDS for IoT systems. [PERSON] and [PERSON] [44] proposed intrusion detection for IoT via a trust management mechanism that collects information about neighboring devices and their reputation. The authors investigated patterns of normal use for the RPL protocol using these to devise trust among the IoT devices and the edge routers. The trust management algorithms devised as part of this approach aim to develop trust and reputation values, which are used to protect against routing-specific attacks, such as sinkhole, selective forwarding and version number. Similarly, [PERSON] et al. [45] proposed a distributed IDS where each node monitors the working of nearby nodes for any abnormal activity. If some abnormality is detected, its packets are blocked and problem is reported to the parent node or root node by Distress Propagation Object (DPO). The system has three subsystems i.e., Monitoring and Grading Subsystem (MGSS), Reporting Subsystem (RSS) and Isolated Subsystem (ISS), which enable collaboration between an IoT device and edge router to facilitate IoT threat detection effectively. [PERSON] et al. [46] proposed a hierarchical and distributed IDS (SGDIDS) that is focused at protection against Cyber-Physical attacks for smart grids systems. The proposed system leverages classification algorithms, such as support vector machine (SVM) and artificial immune system (AIS) in order to determine occurrence of an attack, its type and its origin in the communication system. The SGDIDS shares some similarities with a typical IoT network in that an IoT network can be divided into two levels i.e., IoT devices and the edge routers with the possibility to adopt SGDIDS approach for a hierarchical IDS. Furthermore, the attack surface for smart grids overlaps significantly with that for a typical IoT network therefore the results of this research are relevant within a generic IDS for IoT. [PERSON] et al. [14] presented a network anomaly-based model for intrusion detection and two tier classification model, which is proposed to be used in IoT backbone networks. The authors have focused on two specific attack types i.e., User to Root (U2R) and Root to Local (R2L) demonstrating high detection accuracy with low false positive rates primarily due to introduction of a refinement feature and decreased computational complications.