## 6 Lightweight IDS for IoT Devices
### Collaborative Approach in Designing Lightweight IDS for IoT  
In collaborative techniques, IoT devices work in collaboration and assist other nodes in the intrusion detection process for timely and efficient detection of network anomalies. This approach does not require heavy computational resources, which consequently results in preventing resource exhaustion. The collaboration amongst various nodes also provides a variety of advantages, including lightening the computational load on a single IoT device, parallel inspection of network traffic, reducing computation time, as well as increasing detection rates and accuracy [140; 141]. [PERSON] et al. [140] proposed a collaborative intrusion detection framework called COLIDE for energy-constrained IoT devices. In COLIDE, the intrusion was detected on two levels, i.e., at the device level and the edge router level. At the device level, a lightweight IDS module contains three components: (i) network monitor, (ii) system monitor, and (iii) detection engine. Information collected by the two monitors is passed to the detection engine, which is processed by using attack signatures. Detection at the edge router level contains three components: the Alert Collector (AC), which gathers alerts from the two monitors at the IoT device level; the Correlation Agent (CA), which detects typical intrusions, which are the series of events targeted for specific vulnerabilities; and finally the Detection Agent (DA), which detects anomalies by using alerts collected and correlated by CA and AC. The proposed system used a collaborative approach to detect intrusion into IoT networks, where the edge router plays an important role in detecting effective intrusions. [PERSON] et al. [142] proposed a lightweight solution integrating ML, IoT, and cloud computing, designed for cost-effective distributed computing using devices like the Raspberry Pi. It addresses the demand for hybrid architectures, demonstrating capabilities such as IoT nodes handling modern ML tasks, adaptive management of cloud resources' lifecycle, and organization of cloud resources using IoT edge devices, and minimizing resource costs. The architecture consists of three components: client side, server side, and elastic resource. A case study validated IoT-Pi's effectiveness in minimizing idle instances on AWS cloud resources using a Raspberry Pi 4 Model B, achieving over 70% accuracy in ML predictions. This highlights the feasibility of employing IoT devices for cloud resource management through ML techniques. The whole process consequently executes in serial order, hence making it unfeasible to access the resources concurrently, which leads towards the high elapsed time when coordinates with other components. [PERSON] et al. [143] proposed a distributed and lightweight IDS that consists of fog and cloud layers, where the fog layer includes various modules including detection, feature pre-processing, countermeasure, and performing model training. The attack identification module is deployed in the cloud to classify the various types of attacks. In the presented model, two robust classifiers were combined, namely Variation Autoencoder (VAE) and Multi-Layer Perceptron (MLP). The VAE performed feature extraction and dimensionality reduction on the selected dataset, while MLP was used to detect the specific type of attack. The model evaluation shows that IDS has good detection and high accuracy rates. However, the resources required for model training and testing were not evaluated. [PERSON] et al. [144] proposed the E-Spin IDS architecture, which consists of two components: server-side (Edge-server) and client-side (IoT device). The IoT device contains client components that collect all the system logs and further transfer these logs to the edge server. The edge server performs all the resource-intensive tasks, including parsing logs to extract features, authentication of logs, training classifiers, running classifier models, and module management. The proposed approach aims to minimize the workload on IoT devices.