## 6 Lightweight IDS for IoT Devices
### Feature Selection Based Lightweight IDSfor IoT
The dataset has been collected from the real network, where the features of network packets are fed to the Information Gain Ratio (IGR) to extract the most important features. The accuracy of the proposed IDS was tested on various trained models, where a different number of features were used to train a different model. However, the best accuracy was achieved through a set of 20 features, where the results showed that the model had achieved 100% accuracy. [PERSON] et al. [103] proposed a lightweight attack detection mechanism through the adoption of an SVM algorithm to detect an adversary attempting to inject unnecessary data into the IoT network. Only one characteristic of the network packet, i.e., packet arrival rate per node, has been used to detect the intrusion in the network. The use of a single attribute has reduced the detection time and computational resources. Results showed that the proposed model performed well in classifying the DDoS attacks. However, the proposed detection mechanism cannot distinguish concomitant effects, which results in a high false alarm rate and disrupts the normal execution of a system. [PERSON] al. [128] introduced a lightweight anomaly detection system tailored for IoT networks. In this system, a correlation feature selection method is employed to identify the top 7 features out of an original set of 49. These selected features are then used to train the classification model using the J48 algorithm. During the testing phase, the same seven features are extracted from the test dataset and input into the classification model. This model is implemented on a Raspberry Pi 3 platform, and evaluation results indicate an impressive average detection rate of 99% across all types of attacks. For feature selection-based lightweight IDS, a reflection on the adopted feature selection techniques, dataset used for training and testing, number of features in the dataset, and total remaining features after applying feature selection techniques are presented in Table 6. The table depicts a quick overview of the datasets and the feature selection methods employed. These datasets are used by various feature selection techniques, to select valuable features in the development of resource-efficient IDS for applications like network security and wireless network monitoring. The table also highlights the popularity of filter-based feature selection methods in the design of lightweight IDS, while wrapper-based methods are avoided due to their resource-intensive nature. However, the embedded approach is employed by a few studies, including [103; 124; 126; 113]. Furthermore, it is observed that the correlation coefficient, IG, and other methods may select a varying number of features (e.g., 7, 8, and 9) depending on the application domain and the specific type of attack being targeted. Figure 5 portrays an analysis extracted from the data presented in Table 5, in which it exhibits the percentage of features selected for developing the classification model against the total number of features available within the considered datasets. It can be observed from the presented figure that no author has utilized more than 40% of the total features available within the dataset for developing the classification model. It is observed that most of the research works tend to utilize less than 20% of the total features while also claiming well-performing classification models. This pins the fact that feature selection methods not only reduce the number of features involved significantly but also result in developing classification models that exhibit promising performances for detecting cyber-attacks while having a major impact on less utilization of resources as a dire need for IoT-based devices. Several studies have focused on developing cyber-attack classification models using fewer than 10 features by employing filter-based feature selection methods. Figure 5: Percentage of features selected from the total number of available features in the datasets used in the research [31; 32; 103; 111; 112; 123; 124; 128; 129].