## 3 Security and Privacy Challenges
### Intrusion Detection System
#### 3.4.2 Anomaly-Based Intrusion Detection System (AIDS)  
A statistical or knowledge-based ML model is developed in AIDS to detect any significant deviation from the normal behavior, also known as an anomaly. AIDS can be further classified under statistical-based, knowledge-based, and ML-based technique groups based on specific training methods, as shown in Figure 14. A statistical model of normal user behavior is developed from the datasets collected in a statistics-based approach. A knowledge-based method detects desired actions using available system data, such as protocol details and network traffic samples, while an ML approach develops advanced pattern recognition abilities from its training data. There are numerous techniques proposed in the past to model malicious behavior. One of the simplest approaches is based on statistical methods like threshold crossings. However, currently used methods tend to improve traditional detection rates by exploiting the AI capabilities, in particular ML algorithms with an accuracy beyond 95% and much lower false-negative rates [190].  
* _Statistical AIDS_: A distribution model of a normal behavior profile is created, and events with lower probabilities are singled out as potential threats. Thus, individual packets are monitored to estimate their statistical metrics, such as the median, mean, mode, and standard deviation, to detect deviations from established normal behavior. A univariate class focuses on a single variable analysis, while multivariate models establish the relationships between two or more variables. In a time series model, the observations are made at set time intervals, and any new or different observation is considered dubious if its probability of occurrence at that given time is too low.
* _Knowledge-based AIDS_: A knowledge base of legitimate traffic profiles is created, and any deviation from the profile is considered an intrusion. This technique is also known as an expert system method that reduces false-positive alarms. However, it needs to update its knowledge regularly due to dynamic computing environments.
* _ML-based AIDS_ AIDS exploits ML techniques such as clustering, neural networks, association rules, decision trees, genetic algorithms, and nearest neighbor methods to discover the knowledge from intrusion datasets. The network or host data source and corresponding intrusion or normal as a labelled output value are recorded. A supervised learning method trains a classifier to establish the inherent relationship between the input data and the labelled output value. Fuzzy logic mitigates the high false alarms in IDSs that have numerical data with hard thresholds. The requirement of labelled datasets does not exist in unsupervised learning environments. There are two different classes of datasets: public and private.  
A frequently used public dataset in the past for benchmarking purposes or network security analysis was the DARPA 1998-1999 dataset. An updated version of DARPA 1998-1999 is the Knowledge Discovery and Data Mining (KDD) 1999 dataset, followed by NSL-KDD, and the most recent public datasets are UNSW-NB15 and CIIDS2017 [191]. [PERSON] et al. have conducted an evaluation of Naive Bayes, k-nearest neighbors, decision tree, and random forest ML algorithms on the UNSW-NB 15 dataset for intrusion detection. The experiment results reported an average accuracy of 89.66%, 89.20%, 56.43% and mean absolute error of 0.0252, 0.0242, 0.0867 for random forest, decision tree, and Naive Bayes, respectively. Hence, random forest and decision tree classifiers are a suitable choice for detecting intrusions [192].  
Physical Unclonable Function (PUF) is an alternative authentication scheme without any cryptographic assets burdening the resource-scarce IoT devices.