## 1 Introduction
In this paper, we have implemented a real-world scenario in which we employed a smart thermostat using ESP32, an HTTP page on a cloud server ([[http://16.170.215.67/display](http://16.170.215.67/display)]([http://16.170.215.67/display](http://16.170.215.67/display)) (accessed on 26 April 2024)), and a Raspberry Pi-based adversary node for generating denial of service (DoS) and man-in-the-middle (MITM) attacks to collect a dataset called the intrusion detection in smart homes (IDSH) dataset [22]. The dataset is collected by using lwip and socket library for an ESP32 microcontroller. An ML-based binary class IDS is embedded in a smart thermostat using TinyML [23], which is responsible for monitoring room temperature and controlling HVAC systems. Additionally, this smart thermostat connects to WiFi and uploads air temperature and humidity data to a hosted web page on a cloud-based web services server, where an ML-based multiclass IDS is also deployed. To enhance the security of the microcontroller-based smart thermostat, we propose deploying a lightweight IDS based on XGBoost. Considering that IoT devices in smart homes connect to WiFi routers, they become susceptible to various security risks, including DoS, DDoS, MITM, ransomware, and scanning attacks. The main research objective of this research article is to develop an IDS for IoT devices (a smart thermostat in our case) of smart homes which are directly communicating with web servers through WiFi access points and additional hardware (Raspberry Pi-based edge device) is not available. Therefore, in this work, we proposed a two-layered ML-based IDS which can protect the smart thermostat by embedding an IDS in the smart thermostat and can also protect the cloud by implementing the IDS on the cloud. The main contributions of this paper are as follows:  
* A novel bi-directional computationally efficient ML-based decentralized multiclass IDS is proposed for the deployment on IoT devices and the cloud. * An embedded XGBoost-based IDS for real-time binary classification of attacks in smart thermostats using TinyML is proposed. Moreover, a thorough comparison is made for ANN-, XGBoost-, RF-, and DT-based IDS implementation on low-cost microcontroller-based IoT devices for binary classification. The algorithms are compared in terms of accuracy, inference time, and storage requirement. * A computationally efficient XGBoost IDS is implemented on the cloud for monitoring the incoming traffic from IoT devices and external attacks. The XGBoost IDS is implemented for the identification of DoS, DDoS, MITM, port scanning, injection, backdoor, XSS, and ransomware attacks. Moreover, a detailed comparison of different ML algorithms is made for IDS implementation on the cloud side in terms of accuracy, F1-score, precision, recall, inference time, and computational complexity. * To conduct real-time testing and validation of the IDS deployed on a smart thermostat, we developed a Raspberry Pi-based adversary specifically designed to generate DoS and MITM attacks on the smart thermostat. We collected a new dataset called the intrusion detection in smart homes (IDSH) dataset [22] comprising 4144 samples, encompassing normal activities, DoS attacks, and MITM attacks on the smart thermostat. The rest of the paper is organized as follows: Section 2 presents the literature review on centralized and decentralized IDS. In Section 3, the proposed methodology is explained. Section 4 discusses the results along with a comparative analysis. The paper is concluded in Section 5 along with future research directions.