## 2 Related Work  
An IoT system is vulnerable to different types of attacks [2]. These attacks are explained in detail in [24] and include password cracking attacks, ransomware, port scanning, MITM attacks, DoS/DDoS attacks, backdoors, injection attacks, and XSS attacks. A password cracking attack is launched against a device to guess its password using a commonly available set of passwords online. A ransomware attack is launched to lock a device's data and demand money in exchange for the data. A port scanning attack is used to check which port on a device is open to launch an attack against that port. An MITM attack is used to intercept traffic between any two nodes in the network. A DoS/DDoS attack is used to occupy bandwidth in a network. For example, a device or a set of devices is directed toward a single server to send false queries, making the server unresponsive to the actual queries. A backdoor attack is launched to use/hack devices without anyone knowing. A hacker who launches a backdoor attack has full access to the device. Injection/XSS attacks are launched against web pages to alter their data. Recently, in [25], the authors calculated the energy consumption of running DT-, RF-, and ANN-based ML models for intrusion detection in IoT devices using the TinyML library. However, the energy consumption is based on theoretical calculations, and the ML models were not tested for real-world intrusion detection systems. The authors in [26] developed an IoT device dataset by generating a botnet attack on a smart health service testbed. The dataset is labeled as normal and attack traffic. The authors utilized Wireshark for collecting the dataset. The results show that the accuracy of an RF-based IDS on the collected dataset is 99.98%. In [9], the TON_IoT dataset [27] is used to train multiple ML algorithms for intrusion detection in intelligent transportation systems, where the XGBoost algorithm outperforms other ML algorithms with an accuracy of 99.92%. In [28], the authors developed an enhanced anomaly-based intrusion detection method (EIDM) for classifying 15 attacks with an accuracy of 95%. The first application of random neural networks (RNNs) for IDSs was proposed in our previous work [29] in which an RNN with an artificial bee colony algorithm is used for binary classification of intrusion detection in the cloud. In [30], the authors developed an IDS using the hybrid deep learning model. The proposed technique achieved 96% accuracy, but it incurred a high computational burden. In [31], a five-stack ResNet was used as a deep learning method, trained on two different datasets: N-BaIoT and the power system dataset. The authors in [32] proposed to implement ensemble ML model selection on the cloud and IDS implementation on fog for real-time prediction to reduce the attack detection time. In [33], a distributed IDS approach is presented. Attacks were classified as normal or attack at the fog node. If identified as an attack, further classification occurs at the cloud node. The DNN-KNN algorithm showcased accuracies of 99.77% and 99.85% on NSL-KDD and CICIDS2017, respectively. In [34], a fog computing-based distributed IDS approach is introduced. Data are analyzed for attacks at the fog node, and if detected, relevant information is stored in the cloud server for subsequent action. In [16], an anomaly-based IDS is moved to fog nodes, and the Distributed Smart Space Orchestration System (DS2 OS) dataset is used to train different ML algorithms. RF showed an accuracy of 99.99%. A distributed IDS using fog computing is designed in [35] to detect DDoS attacks in the memory pool of a blockchain-enabled IoT network. The performance of the proposed IDS is evaluated using machine learning algorithms (RF and XGBoost) and evaluation metrics on an actual IoT-based BoT-IoT dataset containing various recent botnet attacks. In [19], the authors presented Passban, an intelligent IDS for edge devices. The IDS was deployed on an IoT gateway developed with Raspberry Pi 3.