# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 7 Open Challenges and Future Directions
Through our research, we have identified efforts, such as [42; 66], which propose to develop intrusion detection capability within the device however these efforts are generally limited in that these require further refinement to take into account unique characteristics of IoT devices such as those explained earlier in this section. 4. **Large-scale attacks:** With the widespread adoption of IoT systems, the number of IoT devices are increasing exponentially with some estimates predicting more than 50 billion IoT devices by the year 2020. The impact of this growth on securing the IoT system is is two-folds; firstly, the enormous scale makes IoT systems a lucrative target for malicious actors, and secondly, it alsopresents IoT systems as a resource which can be used to launch a large-scale attacks. An example of such attacks is the botnets i.e., Mirai botnet and Brickerbot launched a Distributed Denial of Service (DDoS) which compromised the Domain Name System (DNS) service [37]. Moreover, due to the nature of the IoT systems, routing attacks are typically contagious i.e., affecting all the devices within a LoWPAN. These attacks demand a holistic approach to the intrusion detection which is able to monitor and detect the state of the overall network as well as the individual devices. 5. **Limited experimentation and evaluation:** In order to assess the effectiveness of intrusion detection efforts, rigorous experimentation is required for integrating multiple dimensions of the evaluation. Although, experiments have been conducted to demonstrate the effectiveness with respect to detection accuracy and false positive rate, but this evaluation is performed without using appropriate simulation software or hardware to replicate a real-life IoT setting. For instance, a number of efforts have used KDD 99 dataset [77] within an isolated environment to conduct experimentation, however, it has multiple limitations i.e., (1) the KDD 99 dataset does not accurately reflect the current threat types prevalent for the IoT systems and, (2) conducting evaluation in an isolated environment prohibits taking into account important factors such as resource constraints of a typical IoT device. These challenges require explicit efforts to improve the state-of-the-art with respect to the evaluation of intrusion detection schemes within IoT systems. Further, we believe that research into dedicated honeypots for IoT systems is required and will be significant in facilitating thorough evaluation of future intrusion detection approaches. 6. **Unavailability of accurate data:** Through our research, we have identified unavailability of real-world data from an IoT system as one of the bottlenecks to achieve rigorous evaluation. In absence of such data, a number of current approaches have used KDD99 datasets, which contain network traffic data for contemporary computing systems. We believe further research into dedicated honeypots for IoT systems is required and will be significant in facilitating thorough evaluation of future intrusion detection approaches.