## 5 Conclusions and Future Work  
In this work, a two-layered ML-based IDS is proposed. The proposed IDS is trained to be deployed on IoT devices and the cloud side of an IoT network to detect threats as soon as possible. The first layer of the IDS is embedded in the microcontroller-based smart thermostat using TinyML for binary classification. DDoS, MITM, ransomware, scanning, and backdoor attacks are detected on IoT devices. These attacks are labeled as an attack class for binary classification. The results show that the decision tree (DT)-based IDS can detect the attacks with 99.85% accuracy in 11.36 us. The smart thermostat is also tested against real attacks (DoS, MITM) generated by the Raspberry Pi-based attacker node, and the accuracy of XGBoost is 97.59%. The dataset is comprised of 4144 samples, which were collected in this work. The second layer of the IDS is deployed on the cloud, and five ML algorithms, namely LSTM, RF, MLP, Conv1d, and XGBoost, are trained to detect attacks such as DoS, DDoS, port scanning, MITM, XSS/injection, brute force, backdoor, and ransomware. The XGBoost algorithm showed the best results on the cloud with a detection accuracy of 99.5%, followed by RF, which showed the second-best results on the TON_IoT dataset with a detection accuracy of 99.4%. Two FS techniques, chi-square and PCA, are also employed on algorithms trained on the cloud side of the IoT network, but they did not significantly improve detection accuracy. The best results are obtained with chi-square, which showed 98.35% accuracy with XGBoost, while the best accuracy achieved with PCA is 97.67% with XGBoost. The IDS on the cloud detects incoming traffic and, if it is classified as normal, uploads it to the webpage. Based on the experimental results, it is found that the DT-based IDS outperformed ANN, RF, and XGBoost in terms of inference time and memory requirements, while the XGBoost-based IDS outperformed the other ML models in terms of accuracy, precision, recall, f1 score, FPR, and FNR. For an IDS, accuracy is crucial. Therefore, prioritizing accuracy over inference time, XGBoost is the preferred choice for IDS implementation on the cloud and smart thermostat due to its superior performance in terms of accuracy. The XGBoost-based IDS is deployed on the cloud, and prediction results are also shared on the website along with the smart thermostat data. For the future prospects of this work, the presented two-layered IDS will be tested for additional attacks, and we will extend the number of samples in our smart home dataset. Due to limited resources and the restricted access of the lwIP library to network parameters, we managed to retrieve only a limited set of network parameters on the microcontroller. In the future, we will work on extracting additional network parameters at the IoT device. All authors contributed extensively to the work presented in this paper. Conceptualization, A.J., A.-u.-H.Q., and H.L; methodology, A.J., A.E., M.J. and M.N.A. ; software, A.J., A.E. and M.J.; validation, A.J., A.E., M.J., M.N.A., A.-u.-H.Q. and H.L. ; formal analysis, A.J., H.L., M.N.A., M.J. and A.-u.-H.Q. ; investigation, A.J., M.N.A., H.L. and A.-u.-H.Q. ; resources, A.J., A.E. and A.-u.-H.Q. ; data curation, A.J., A.E., M.N.A., H.L. and M.J.; writing--original draft preparation, A.J., A.E., M.J. and A.-u.-H.Q. ; writing--review and editing, A.J., A.E., M.J., M.N.A., H.L. and A.-u.-H.Q. ; visualization, A.J., M.N.A. and A.-u.-H.Q. ; supervision, A.J. and A.-u.-H.Q. ; project administration, A.J. and A.-u.-H.Q. ; funding acquisition, A.J. and A.-u.-H.Q. All authors have read and agreed to the published version of the manuscript.