## 6 Lightweight IDS for IoT Devices
### Ensemble Feature Selection Based Lightweight IDS for IoT  
Traditional feature selection techniques, encompassing wrapper, filter, and embedded methods, effectively address the challenge of dimensionality in various domains. This efficacy is particularly notable in network traffic analysis, where the identification and removal of irrelevant, redundant, and less significant data elements occur through rigorous feature selection processes. However, despite the benefits of feature selection, it is imperative to acknowledge certain limitations, which are delineated as follows:  
Individual biases can influence the selection of features, given that each technique has its own distinct evaluation criteria. Consequently, the set of features selected by one technique may vary significantly from those chosen by another technique. Utilizing a wrapper approach in feature selection may involve employing a powerful classifier that proves effective for specific datasets and problem domains. However, it may also entail a high computational demand. Relying solely on a single feature selection method can lead to a suboptimal feature set, particularly due to its susceptibility to local optima. This challenge becomes more pronounced when dealing with multi-objective fitness functions or complex search spaces. To address the limitations outlined above, the introduction of ensemble feature selection techniques has proven invaluable. The word 'ensemble' refers to a group of individuals or elements that work together toward a common goal. As the proverb goes, 'two heads are better than one'. Similarly, when the ensemble approach is used in FS, it employs a range of methods such as method_1, method_2,..., method_n, as illustrated in Figure 6. Each method generates its own list of feature sets based on specific criteria. These lists are then aggregated using voting, ranking, or score-averaging techniques, resulting in a final consolidated list of the most relevant features. This strategy, prevalent in classification quandaries, leverages multiple weak classifiers instead of a singular robust classifier, thereby mitigating the generalization issue in classification while demanding fewer computational resources [130]. Recently, EFS has emerged as a pivotal factor in enhancing the efficacy of IDS deployed in IoT devices and networks [131; 132]. Similar to conventional FS methods, the EFS framework offers a potent and streamlined approach to eliminating extraneous network traffic. This is particularly noteworthy given the inherent constraints of IoT devices, characterized by limited bandwidth and processing capabilities. Figure 6: Ensemble feature selection. Notably, the ensemble approach has transcended its origins in classification to encompass FS within other realms of ML. Irrespective of the specific FS methodologies employed, the core tenet of ensemble FS remains constant, which is to combine the selected feature sets from various techniques to enhance performance and provide stability [133]. The intrinsic diversity among individual selection techniques yields a more comprehensive feature set for the subsequent feature-combining process. Historically, numerous algorithms and methodologies have been proposed for ensemble FS. The focal point of much of this research delves into either the optimal amalgamation of feature sets from individual techniques or determining which individual feature techniques merit inclusion within the ensemble model. In the study conducted by [134], the authors integrated output features derived from distinct FS techniques by framing the task as a Multiple Criteria Decision-Making Problem (MCDM). The initial set of features was generated using four filter-based techniques. The Evaluation Based on Distance from Average Solution (EDAS), a variant of MCDM, was employed to assess the four subset features using two distinct metrics: positive distance from average and negative distance from average.