# A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT
## 4 State-of-the-Art in IDS for IoT
### Anomaly-Based Approaches to Intrusion Detection
The authors have used both supervised and unsupervised reduction techniques, such as Linear Discriminant Analysis (LDA) (supervised) and Principal Component Analysis (PCA) (unsupervised), where PCA is used for feature selection and extraction, and LDA provides fast and efficient IDS. [PERSON] et al. [47] presented a deep packet anomaly detection system involving feature selection conducted by pattern matching. The authors focused on two Internet-enabled devices i.e., a weather station and an interactive networked video camera, which simulated a sensor and actuator respectively. The evaluation of the approach demonstrated that the sensor was able to detect 99.9% of abnormal packets whereas the IoT actuator demonstrated 92.9% detection accuracy. A user-centric approach is proposed by [PERSON] and [PERSON] [48] consisting of two major blocks i.e., a habit-based approach for anomaly detection system and semantic-based firewall for access control and security during communication. The authors consider use of IoT devices within a private setting, such as home networks with devices, including a wrist bracelet, a connected light bulb and a smart TV to model various user behaviours. Within this context, the authors focus on the personal data collected and communicated by the devices. The authors do not discuss details of the detection accuracy, performance efficiency, visibility for the intrusion detection and its placement. [PERSON] et al. [49] propose using a Bayesian Spatial Temporal (HBST) model to achieve effective and timely detection of a compromised node at an early stage. The system achieves high detection rate and low false positives rates with low detection samples. As with other domains of computer and information security, recent efforts for intrusion detection have also attempted to leverage advancements in machine learning and artificial intelligence to improve efficiency and accuracy of the detection process. In this regard, [PERSON] et al. [50] present one of the first efforts focusing on protection against the IoT botnets which are one of the emerging threats for IoT systems. The authors use deep learning autoencoders to establish an anomaly detection engine which is evaluated against two major botnets i.e., Mirai and BASHLITE. With respect to placement of the IDS, authors use a hybrid approach where by a central unit coordinates with device level encoders (each encoder is responsible for profiling individual IoT device). Similarly, [PERSON] et al. [51] use deep learning to achieve effective detection of IoT botnets. Furthermore, both approaches are similar in that they use patterns within network traffic to discover anomalous behavior representing infection caused by botnets. In terms of placement of the intrusion detection system, the authors have adopted a network-based approach employing deep packet inspection techniques. Moreover, [PERSON] et al. [52] presented an effort to achieve efficient intrusion detection and prevention for IoT systems. Authors have proposed an integrated system for detection and response with specific attention on directing attacks, such as hi surge, sinkhole and wormhole attacks. Although the proposed system has been implemented with Contiki, evaluation results especially with respect to performance efficiency are not available.