## 6 Lightweight IDS for IoT Devices
### Feature Selection Based Lightweight IDSfor IoT
To improve accuracy and minimize computational cost, the value of IG has been computed for each feature, where 22 out of 47 features were selected based on the value being greater than zero. Furthermore, the classification models have been prepared using different variants of the DT algorithm, including C5, CHAID, CART, and QUEST. The peak accuracy of the proposed model for real-world datasets was found to be 83.8%. However, the proposed method is a signature-based technique; hence, the model may not function well against zero-day attacks. [PERSON] and [PERSON] [124] proposed NIDS based on RF as the classification algorithm to train and predict intrusions in an IoT environment. Two publicly available datasets, including KDDCUP99 and NSL-KDD, were employed to train and test the classifier. Out of 41 features, only 10 features were selected. As a result, the training and testing time required by the model were reduced, along with reporting 99.9% accuracy. However, details and approaches adopted for feature selection were not discussed. [PERSON] and [PERSON] [125] presented a framework for anomaly detection in an IoT environment. The proposed system included three phases: (i) Data Aggregation; which collects the data generated from IoT sensors, (ii) Data Preprocessing; which removes the duplicate records from collected data and performs feature selection that reduces the dimensionality of data, (iii) ML IDS; in which SVM, RF, Back propagation Neural Network (BPNN), and DT were used to detect the anomalies in the IoT network. Experiments were performed on different scenarios using different self-collected datasets. The proposed lightweight IDS produced promising results in terms of accuracy and time requested for training and testing the models. However, the evaluation of the classification models in terms of resource consumption was not discussed. Another lightweight IDS, termed Hawkware, was proposed by [PERSON] et al. [126]. The IDS consists of two main modules: the monitor module, which checks for the network and device behaviors to extract the relevant features, whereas the detection module keeps scanning the suspicious behaviors indicating network intrusions by utilizing input from the monitor module. The proposed detection system incorporates Network Behavior Feature Vectors (NBFVs) and Device Behavior Feature Vectors (DBFVs) to reduce the computational overheads. An NBFV collects the features extracted by the packet analyzer from packet headers, whereas a DBFV collects features consisting of system calls. To catalyze model training, the training phase has been performed offline, which reflects a biased action towards the real-world implementation. Furthermore, the use of a Raspberry board with a sufficient number of resources consequently reveals that the proposed solution may not be able to run resource-constrained devices, such as embedded IoT systems. [PERSON] et al. [127] presented a novel lightweight IDS based on fuzzy logic for Message Queuing Telemetry Transport (MQTT)-based IoT applications to protect low-configurable devices from DoS attacks. The proposed IDS has been designed to achieve three major objectives, i.e., detect DoS attacks in IoT networks, make detection efficient in terms of computational cost, and ensure the detection of attacks is timely and quick. In the proposed detection mechanism, the fuzzification technique analyzes the network traffic considering two ratios, including Connection Message Ratio (CMR) and Connection Acknowledgement Message Ratio (CAMR). Considering these considerations, relevant rules are implemented to determine if a request is safe or harmful. The features used to develop these fuzzy rules are chosen from the network trace dataset. In this phase of feature selection, devices gather critical features from the network traffic. Nonetheless, the precise methodology of how these features are selected is not detailed. [PERSON] et al. [32] proposed IDS to detect DoS attacks, where the classification model was based on the J48 algorithm.