## 5 Discussion
### Analysis and Selection of Models  
The experimental results demonstrate the performance trade-offs among the various models evaluated in this study. Notably, DT and RF emerged as best performers for both binary and multiclass classification tasks with significantly low computational costs. DT, in particular, proved efficient with concise training (0.12 s) and testing times (0.01 s). The IoT environment processes continuous streams of real-time data. Real-time processing requires efficient algorithms to process data promptly and detect and respond to threats. Delayed detection (e.g., batch processing) may affect the security [56]. Hence, from this perspective, DT could be the best candidate for real-time/near-real-time intrusion detection in applications where fast detection and low energy consumption are critical.  
Similarly, the ensemble techniques (GB and XGBoost) performed well but were more computationally expensive, thus suitable for scenarios where computational resources are not severely limited. While LR performed well in binary classification, it struggled more with the multiclass scenario, likely due to the complexity and imbalanced nature of the classes in the MQTSet. Its computational efficiency makes it a potential choice for time-sensitive applications, but its trade-off with accuracy in multiclass classification limits its effectiveness.  
MLP and DNN underperformed compared to others, with the DNN having the lowest accuracy. Moreover, the computational cost of models like DNN may not be suitable for resource-constrained applications. For instance, the execution time of DT was reduced by approximately 99.98% compared to DNN, highlighting the importance of selecting less complex models in real-time scenarios. Similarly, RF offers a significant reduction in execution time, with a 97.37% reduction compared to MLP in the binary classification case, and an 88.58% reduction in the multiclass case, without sacrificing detection accuracy. This efficiency highlights the potential energy savings, as the reduced computational complexity scales directly with lower power consumption, which is especially beneficial in IoT environments.  
Additionally, the importance of minimizing false negatives versus false positives should be considered based on the security priorities of the IoT network. As evidenced by the confusion matrices, different models offer varying trade-offs in the false positive/negative aspects. High false positives disrupt operations, while false negatives miss threats. Models with low FPR, such as RF and GB, are preferable in operational settings where false alarms can lead to unnecessary resource utilization. Conversely, models with high FNR, like DNN and LR, require further optimization to ensure comprehensive threat detection without sacrificing usability, particularly in multiclass scenarios where the risk of missed detections is higher.  
However, selecting the appropriate model would depend on the application-specific requirements. Due to their efficiency, RF and DT could fit in scenarios with limited computational resources. In environments where computational power is less constrained, ensemble methods like GB and XGBoost could be more advantageous. On the other hand, the extended computational times of DNNs and MLP render them less practical for real-time processing but potentially valuable for offline analysis or environments with enough computational resources. Hence, it is important to strike a balance based on the specific use case, available resources, and acceptable performance-complexity trade-offs.