## 6 Lightweight IDS for IoT Devices
### Feature Selection Based Lightweight IDSfor IoT  
FS-based lightweight IDS are generally designed by reducing the number of features involved in producing the network traffic classification model [108]. This is performed by avoiding irreverent and redundant features and by keeping relevant features selected from a large number of feature sets [30]. This type of system can perform efficiently to detect an intrusion in the IoT network while consuming the minimum number of resources. Hence, it results in an efficient and effective detection of cyber-attacks. There are three major steps in FS-based IDS, which are data collection, model training, and finally testing the classification model. Before the training phase, feature selection or feature reduction are sub-steps commonly adopted to reduce the number of attributes within a given dataset that is further used to train a classification model. This in turn helps to improve the resource utilization efficiency of the prepared model along with improving its performance in terms of classification accuracy and reducing the number of false alarm rates generated by the IDS incorporating the built classification model [109]. The paper [110] proposed a framework aimed at improving anomaly detection in IoT systems using XAI methods. The framework utilizes single ML models (such as Decision Trees (DTs) and Deep Neural Networks (DNNs)) and ensemble methods (such as Random Forest (RF) and Bagging) to detect anomalies in IoT. Additionally, it incorporates feature importance analysis using seven different XAI methods, including SHAP, LIME, CEM, LOCO, PFI, ProfWeight, and ALE, to identify the most critical features for anomaly detection. The framework is evaluated on two real-world IoT datasets: a smart manufacturing dataset(MEMS) and N-BaIoT. The study finds that ensemble models generally perform better for anomaly detection tasks, and SHAP-based feature importance analysis highlights key features that help in identifying anomalies. The experiments were conducted using high-performance computing, which means the proposed framework may not be suitable for resource-limited IoT-based systems. Moreover, no details are provided regarding resource consumption during training/testing. The paper [111] addressed the opacity issues in ML and DL-based network IDS, which limit their interpretability in real-world networks. In this study, the proposed XAI framework introduces four novel architectures--ExplainDTC, SecureForest-RFE, RationaleNet, and CNNShield--designed to enhance both transparency and accuracy in IDS. These models incorporate various XAI techniques, such as Local Interpretable Model-agnostic Explanations (LIME), SHAP, EL15, and ProtoDash. The proposed framework is tested on the UNSW-NB15 dataset and offers high accuracy, but it requires significant computational power to run effectively, which impacts its real-time responsiveness. [PERSON] et al. [112] presented an IDS tailored for IoT-based systems with resource constraints. They utilized a \(\chi^{2}\) filter-based technique to pinpoint the most effective features for training diverse ML classifiers, including RF, DT, SVM, LR, and KNN. The performance of these classifiers was further assessed based on CPU usage, memory consumption, False Positive Rate (FPR), True Positive Rate (TPR), as well as training and testing times. The evaluation results underscore the robust performance of RF, outperforming other classifiers across all assessed criteria. [PERSON] et al. [113] employed a novel feature selection method known as Extra-TreeClassifier to identify and choose crucial attributes from the input dataset. This approach relies on a model-based technique, utilizing the RF algorithm to evaluate the importance of each feature through the Gini Impurity measure. The top 20 most important features are selected from both BOT-IoT and TON_IoT datasets, discarding less significant ones and retaining the top K-best features for subsequent analysis.