## 6 Lightweight IDS for IoT Devices
### Feature Selection Based Lightweight IDSfor IoT
[119] IMPACT, standing for IMPersonation Attack deteCTion, is a streamlined classification model designed for IDS. It consists of three primary components: feature extraction, feature selection, and classification. The feature extraction process is conducted using a deep Neural Network, specifically a Stacked AutoEncoder (SAC). For feature selection, the model utilizes Mutual Information (MI) and C4.8 wrapper methods. The classification model is initially constructed by inputting 154 features into the SAC, from which a new set of 50 features is derived. These new features are then added to the original training and testing datasets, resulting in an expanded dataset comprising 204 features. In feature selection, 204 features were given to wrapper methods, which selected optimal features. Finally, the selected feature set was given to Support Vector Machine (SVM) classification to train the detection model. The trained model was able to effectively classify generic and attack packets. However, a comparative analysis between IMPACT and other models showed that it produces high false alarm rates and low detection accuracy. Another study [120] proposed a two-dimensional projection-based lightweight IDS framework that consists of three major parts. First, data preparation involves balancing the highly imbalanced AWID2 dataset using undersampling, which reduces the prevalence of normal samples. In the second part, data preprocessing, a RF model is used to perform feature selection by ranking the most important features. These selected features are then projected into images using the zigzag scan pattern from the JPEG image compression technique. Finally, the images are classified using the EfficientNet CNN. The proposed framework achieves an accuracy of 99.91% with a false positive rate of 0.11%. However, the high computational cost and relatively long training time make it less suitable for resource-constrained IoT networks, where rapid detection is crucial. The study [121] elaborated that relevant features play a vital role to prevent overfitting issues and help in designing lightweight ML-based IDS. Using the AWID2 and AWID3 datasets, this study focused on selecting a minimal set of 16 expert-driven features that can generalize across various versions of 802.11 networks. The features were chosen for their relevance and transferability across different network types, making IDS models lightweight and adaptable. The study demonstrated that the selected features yielded high detection accuracy: 99.55% for shallow learning models and 97.55% for deep learning models. Expert-driven feature selection is essential in developing effective ML models, particularly in complex fields like cybersecurity. However, this approach can be biased and may overlook important features, potentially reducing the model's overall effectiveness. Another paper [122] presented the effectiveness of combining features from both 802.11-specific protocols and non-802.11 protocols, such as TCP, UDP, and ARP, in detecting application layer attacks, such as website spoofing, using the AWID3 dataset. The results show that the combined feature sets significantly enhance detection accuracy, achieving up to 96.7%. This research highlights the importance of relevant features like frame length and signal strength (from 802.11) and TTL (from non-802.11) and deduces engineered featuresto further improve the detection of complex attacks like botnets. Moreover, the study demonstrated that combining these features provides a more robust model for detecting application layer attacks. However, the paper does not address model evaluation based on resource consumption. [PERSON] et al. [123] presented a novel misuse-based IDS, where the proposed system consists of two parts. In the first part, the UNSW-NB15 dataset was used to design an integrated rule-based IDS model. In the second part, a real-time dataset was generated by using a virtual environment to evaluate the performance of the designed IDS model.