## 3 Intrusion Detection Systems  
An intrusion detection system (IDS) is an essential part of any information security system, and is aimed to detect attacks and anomalies in the information systems. Depending on the type of the input data, it is possible to outline host-based and network-based IDS. The network-based IDS monitors and analyzes the network traffic, while the host-based IDS collects and analyzes logs of the operating system and applications. The typical architectural solution of the IDS includes components for data collection and processing, analysis, and attack (or anomaly) detection and response (see Figure 3). The basic components of the IDS also include a data repository that stores collected raw data and triggered alerts, and a knowledge base that contains information about attack detection rules, signatures, or malicious activity patterns. There are two main approaches to detect attacks or anomalies in the information system: signature-based and based on artificial intelligence (AI) [34]. The signature-based approaches detect attacks using pattern-matching techniques to find a known attack; that is why the attack knowledge base has to be kept constantly updated in order to preserve high level of the attack detection. This type of IDS demonstrates high performance in detecting known types of the attacks; to detect unknown or zero-day attacks, the AI-based approaches are adopted. Currently, researchers have proposed a wide variety of AI-based solutions including adaptive resonance theory [35], genetic algorithms [36; 37], clustering [38], fuzzy logic [36], and deep networks such as convolutional neural networks [39; 40], recurrent neural networks [41], deep auto-encoders [42], etc. Further classification of the IDS is based on how these components are connected and coordinated in the system. Thus, there are monolithic, distributed, hierarchical, and agent-based systems [43; 44]. The distributed IDS assumes that each node of the information system has its own IDS which are able to communicate with each other, and there is one dedicated IDS server that is responsible for the final data analysis and decision-making. In the concept of the hierarchical IDS, the local IDSs are grouped in clusters and each cluster has a selected head, a node that communicates with other clusters [45]. The architecture of the IDS is usually selected based on the type of the monitored information system and available computational, energy, and network bandwidth resources. For example, the typical IDS architecture for cloud intrusion detection is a distributed one. The primary reason for this choice is the necessity to analyze large volumes of network traffic, and acceleration of the computations on the data streams. For the IoT-based systems, such as Smart Home systems, the recommended IDS architecture is a distributed hierarchical agent-based one [43]. This is explained by a fact that modern Smart Home systems are usually shipped with a set of cloud-based services provided by a product manufacture. In this case, the software IDS agent is installed on a home \"smart\" router using specialized middleware. Such an agent is capable of implementing different functions, including monitoring data flows from sensors, their preliminary analysis, and forwarding the analysis results to the master component located in the service provider cloud. The typical architecture of the Smart Home IDS is given in Figure 4. This architecture, on one hand, allows selecting a node with the more powerful resources; on the other hand, it supports fast preliminary analysis of the locally generated data with further advanced analysis implemented by a service provider. Another certain advantage of such approach is the ability to apply knowledge on the security incidents across different controlled Smart Home systems. The only serious drawback is significant privacy risks for the Smart Home users due to possible data leakage.