## 6 Lightweight IDS for IoT Devices
### Ensemble Feature Selection Based Lightweight IDS for IoT
The results confirmed that the proposed methodology effectively reduced the initially generated set of features from the FS technique without markedly compromising the classification accuracy. In another study, the authors introduced an ensemble technique that integrates subsets of features acquired from different filter techniques by leveraging feature-class and feature-feature mutual information [135]. This approach involves a sophisticated combination of feature ranking and feature relevancy methods. The efficacy of the proposed model was assessed across 19 datasets, two of which were dedicated to classifying diverse networking intrusions within the cyber-security domain. Notably, one of these datasets, known as the NSL-KDD dataset, yielded an impressive classification accuracy of approximately 98% when analyzed using the ensemble model. In [131], a novel hybrid mechanism has been developed for assessing and merging distinct sets of features selected through various filter-based FS techniques. This innovative approach, termed Ensemble Automatic Feature Selection (EAFS), is centered on evaluating a subset of features by integrating three different objectives: subset accuracy, the number of features in the subset, and the training time for the subset. The evaluation process itself is based on a normalized score of mixed (NSOM) and ranked based on the highest NSOM value. Furthermore, to address decision bias during the merging process, several set-based operations, such as union and the intersection of the subset features, were conducted to derive the final selected set of features. The efficacy of the proposed model was evaluated by conducting tests on three distinct datasets, namely UNSW-NB15, CIC-IDS2017, and CSE-CIC-IDS2018, to classify different types of network attacks. These datasets encompassed extensive samples of network traffic data, totaling millions of instances, and encompassed a wide range of attack types. The ensemble model proposed in this study demonstrated exceptional performance, particularly when combined with the random forest classifier. The achieved accuracy on the aforementioned datasets were notably high, with values of 98.37%, 99.92%, and 99.04% for UNSW-NB15, CIC-IDS2017, and CSE-CIC-IDS2018, respectively. In [132], the authors proposed a new EFS approach, termed Ensemble Feature Selection for Lightweight IDS (ELIDS). The proposed approach leverages the strength of seven filter-based methods, which aim to reduce the number of features used for developing the classification models while also converge the selection of features towards the most significant ones. Several classification models are built using several learning algorithms, where these models are evaluated for their performance and resource consumption using both in-domain and cross-domain testing techniques. The most significant results are exhibited over the cross-domain evaluations in which the classifiers built using the individual FS methods fall noticeably in their accuracy, whereas the classifiers built using the proposed ELIDS approach show robustness by outperforming existing techniques by large margins. ELIDS exhibited a higher accuracy rate by at least 23.7% over conventional solutions while considering Random Forest as the learning algorithm. The authors in [136] have introduced an ensemble model that amalgamates two subsets of features: one derived from information gain and the other from gain ratio. This model underwent rigorous testing using the IoTID20 [137] and NSL-KDD datasets. The result showcased an exceptional performance on both datasets concerning classification accuracy and outperformed several state-of-the-art intrusion detection systems. Furthermore, another proposed model focused on enhancing feature selection confidence by employing an ensemble technique across multiple filter-based feature subsets [138]. The ensemble model integrated three correlation filters, namely Kendall, Spearman, and Pearson, followed by a nomination procedure.