# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 2 Existing Surveys of Intrusion Detection for IoT  
With the evolution of IoT and its application, the volume and variety of attacks for such systems have increased requiring dedicated efforts to investigate intrusion detection systems for IoT systems. Furthermore, IoT paradigm shares similarities with concepts, such as Mobile Adhoc Networks (MANETs) and Wireless Sensor Networks (WSNs). Consequently, a number of studies have been performed to review the state-of-the-art within intrusion detection for these paradigms. For instance, [PERSON] et al. [21; 22; 23] presented state-of-the-art with respect to IDS for the MANETs, whereas [PERSON] et al. [24; 25] have reviewed existing IDSs for WSNs. However, our focus in this paper is solely on the intrusion detection approaches for the IoT system taking into account the unique characteristics of this paradigm. Our research has identified [17; 18; 19; 26] as existing efforts to review literature related to intrusion detection for IoT. A comprehensive analysis of these surveys is discussed below and summarized in Table 1, which also highlights limitation of these efforts to take into account performance overheads of existing intrusion detection approaches for IoT. [PERSON] et al. (2017) defined a term called _Interaction Ability_ of an IDS to assess the level of holistic detection intelligence. This parameter is defined as the ability of an IDS to interact with different service layers within the system i.e., Network Interface, Internet, Transport and Application layers with maximum achievable interaction ability score as four. Authors have attempted to review seven recent intrusion detection systems against the interaction ability metric to identify respective efficiency. Although interaction ability is a useful indicator, however, we believe the IoT intrusion detection landscape requires rigorous analysis of existing efforts. For instance, one of the unique features of IoT systems is their resource constraints and interaction ability is agnostic of this significant characteristic. For instance, although [PERSON] and [PERSON] (2010) scores high (three) for interaction ability, indicating its efficiency to protect a IoT system however, a deeper analysis of the system highlights that it is remarkably CPU intensive which will affect its suitability for a typical IoT system. [PERSON] et al. (2018) presented a recent survey of IDS research efforts for IoT aiming to identify leading trends, open issues, and future research possibilities. The authors classified existing intrusion detection efforts based on detection method, IDS placement strategy, security threat and validation strategy. Although the authors present a comprehensive system to analyze existing intrusion detection efforts, however, similar to ([PERSON] et al., 2017), this effort is agnostic of the performance overhead of intrusion detection systems. [PERSON] et al. (2019) presented a multidimensional review of efforts to achieve effective network-based IDS (NIDS) for IoT. The study is significant as it presents a comparative review of existing NIDS tools and datasets available, which can help IoT security practitioners to evaluate different tools available. Furthermore, the authors have presented a brief review of select academic efforts for NIDS however the review is focused on security characteristics of these systems with limited coverage of literature and performance metrics. In addition to the above, [PERSON] et al. (2016) studied game-theoretic approaches to intrusion detection within IoT systems, highlighting limitations of using game theory and Markov decision processes to perform effective intrusion detection. Authors conducted a comparative study of existing intrusion detection approaches analyzing metrics, such as true positive, false positive, true negative and false negative to assess the performance of the individual schemes.