# HH-NIDS: Heterogeneous Hardware-Based Network Intrusion Detection Framework for IoT Security
## 2 Related Works  
Machine learning and deep learning (DL) have been widely adopted in anomaly-based IDS to detect unseen attacks [17; 18; 19]. The authors in [20; 21] have experimented with various machine learning algorithms on an IoT-based open-source dataset. They have achieved up to 99% accuracy by applying the random forest (RF) classifier; however, the dataset used in this research was small (357,952 records) compared to other practical datasets. RF has also been claimed, in [22], as the best algorithm for detecting anomalies. Meanwhile, DL has shown better performance when dealing with large datasets. For instance, researchers in [23] have trained deep neuron network (DNN) models on six different datasets with the best training accuracy in the range 95% to 99% on the KDDCup-99 and NSL-KDD datasets. On the same datasets, the system in [24] has achieved similar results (up to 99% detection rate) by using a deep network model with an automatic feature extraction method. Even though ML and DL are prominent techniques for anomaly-based IDS with high detection rates, the trained DL models usually require heavy computational resources, which are limited on standard IoT devices. Table 1 shows a summary of anomaly-based IDS for IoT networks. The paper [25] has introduced a federated self-learning anomaly detection in IoT networks on a self-generated dataset. Similarly, authors in [26] have proposed a decentralised federated-learning approach with an ensembler, which combines long short-term memory (LSTM) and gated recurrent units to enable anomaly detection. Researchers in [27] have tested various ML algorithms on a generated dataset, called MQTT, for IoT network attack detection and achieved an accuracy of 98%. DL algorithms have also been used to generate detection models from various IoT datasets. For instance, authors in [28] have built deep belief network models from the CICIDS 2017 dataset to classify normal records from six different attack types, with an average accuracy of 97.46%. In [29], the Yahoo webscope s5 dataset has been used as input for convolutional neuron network (CNN) and recurrent autoencoder algorithms. Authors in [30] have generated lightweight detection models based on a deep autoencoder from the Bot-IoT dataset. The best setup has reached 97.61% F1-score; however, the hardware platform for experimenting with the system is not mentioned. The self-generated dataset is collected in [31]; the data are fed into a graph neural network, which has produced up to 97% accuracy in the literature. The IoT-23 dataset has been trained with supervised-learning methods. Table 2 presents the summary of anomaly-based IDS on the IoT-23 dataset. The authors in [32; 33] have applied an ensemble strategy, which combines DNN and LSTM. The paper [34] has proposed a universal feature set to detect botnet attacks on the IoT-23 dataset. However, the proposed feature extraction module is tool-based, which can cause dependency and add \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Work**} & **Publication** & \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Platform**} & \multirow{2}{*}{**Accuracy**} \\  & **Year** & & & \\ \hline
[25] & 2019 & Self-generated & Redeon Rx 460 GPU & 95.6\% \\
[26] & 2020 & Modbus network & Lambda GPU & 99.5\% \\
[27] & 2020 & MQTTset & Core Intel i7 dual, 16 GB & 98.0\% \\  & & & of RAM & 99.4\% \\
[28] & 2020 & CICIDS 2017 & Core Intel i7, 16 GB of & 99.4\% \\
[29] & 2021 & Yahoo Webscope S5 & Google Colab & 99.6\% \\
[30] & 2021 & Bot-IoT & Not mentioned & 99.0\% \\
[31] & 2021 & Self-generated & Not mentioned & 97.0\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of anomaly-based IDS for IoT networks. extra overhead [35]. Malware and botnet analysis on the IoT-23 dataset has been examined in [36; 37]. Authors in [38] have reported 99.9% accuracy by applying hyper-parameter optimisation on the deep ensemble model (CNN and RF).