# IoT Intrusion Detection Taxonomy, Reference Architecture, and Analyses
## 5 Intrusion Detection System (IDS) in IoT
### IDS Datasets Appropriate for IoT
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Ref.** & **DL Approach** & **Strategy** & **Dataset** & **Advantage** & **Disadvantage** \\ \hline
[83] & DNN & Classification & NSL-KDD &
\begin{tabular}{c} Real-time, high accuracy, \\ utilizing a fog computing \\ \end{tabular} & Needs more time and \\ \hline
[101] & Vector-CNN &
\begin{tabular}{c} Feature extraction \\ using VCN and \\ Classification using \\ FCN \\ \end{tabular} & Bot-IoT & Scalable detection, less time & Works better with selected \\ \hline
[102] & LSTM & Classification &
\begin{tabular}{c} Own real data and \\ ADFA-LD \\ \end{tabular} & Real-time, high accuracy & Needs more time \\ \hline
[103] & LSTM & Classification & Own real data & Real-time, high accuracy & Needs more time, more \\  & & & & resources \\ \hline
[105] & Auto-Encoder & Classification & Own real data & Self-adoptive, low false neg & Does not match large scale \\  & & & & data \\ \hline
[106] & Hybrid -DNN & \begin{tabular}{c} Classification, \\ prediction \\ \end{tabular} & \begin{tabular}{c} KDD99 and \\ NSL-KDD datasets \\ \end{tabular} & \
\begin{tabular}{c} Suitable for heterogeneous \\ environments, comparison with \\ ML techniques \\ \end{tabular} &
\begin{tabular}{c} Average accuracy, fewer \\ training samples \\ \end{tabular} \\ \hline
[107] & LSTM & Prediction, regression & Sensory data &
\begin{tabular}{c} Prediction accuracy, real-world \\ data, comparison with other \\ results \\ \end{tabular} & Does not handle \\ \hline
[108] & LSTM & Classification & CIDDS & \
\begin{tabular}{c} Comparison with ML \\ techniques \\ \end{tabular} &
\begin{tabular}{c} Not suitable for Zero-day \\ attacks, not suitable for \\ heterogeneous env. \\ \end{tabular} \\ \hline
[109] & \begin{tabular}{c} Simple neural \\ network \\ \end{tabular} & Classification & NSL-KDD & \
\begin{tabular}{c} Low processing time, high \\ detection accuracy, scalability \\ \end{tabular} &
\begin{tabular}{c} Not real-time capable, \\ non-suitable for zero-day \\ attack \\ \end{tabular} \\ \hline
[110] &
\begin{tabular}{c} Simple Neural \\ network \\ \end{tabular} & Classification & Own real data & Real-time usage, high detection \\  & & & accuracy, & \\ \hline
[111] & ID-CVAE & Classification & NSL-KDD & Less complex, low latency & High false positive, needs \\  & & & & more resource for training \\ \hline
[112] & GA and DBN & Classification & NSL-KDD & High accuracy, self-adaption & Lack experiments on the \\  & & & & test-set, does not match \\  & & & large scale data \\ \hline
[113] & DNN & Classification & Own real data & Real time detection & needs more time \\ \hline
[114] & BiRNN, LSTM & \begin{tabular}{c} Malware analysis, \\ Feature extraction \\ \end{tabular} & IoT application, & \
\begin{tabular}{c} Comparative accuracy with \\ various ML techniques, \\ self-training, high accuracy, \\ multiple models \\ \end{tabular} &
\begin{tabular}{c} Not suitable for complex \\ patterns, computational- \\ complexity-learning, \\ random initialization \\ \end{tabular} \\ \hline
[115] & \begin{tabular}{c} GRU, Random \\ forest \\ \end{tabular} & \begin{tabular}{c} Feature extraction, \\ Classification \\ \end{tabular} & KDD-99 & \
\begin{tabular}{c} Multi-layered IDS, \\ Comparisons with existing IDSs \\ \end{tabular} &
\begin{tabular}{c} Outdated dataset, \\ stationary model \\ \end{tabular} \\ \hline
[116] & Vector-CNN & Feature extraction & NSL-KDD dataset & Needs minimum data & Need more resources as \\  & & & data increase \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of deep learning techniques that are used for anomaly-based IDSs in IoT. records, including DDoS, DoS, OS and Service Scan, Key-logging, and data exfiltration attacks [16]. The Bot-IoT, compared to other datasets, is dedicated to the validation of IDS within an IoT environment. The Botnet dataset is an internet-connected devices-based dataset containing training and test data that include 7 and 16 types of botnet attacks, respectively [118].