## 6 Lightweight IDS for IoT Devices
### Feature Selection Based Lightweight IDSfor IoT
These selected features play a pivotal role in training and testing five machine learning classifiers, culminating in the development of an efficient intrusion detection model. The paper focuses on the development and evaluation of the proposed model for detecting DDoS attacks in resource-constrained IoT devices. However, the work does not provide information on CPU and memory usage by the proposed solution. In another recent study conducted in [12], a machine learning-driven approach is employed to formulate a lightweight IDS model. The authors employ fine-tuned ridge regression-based methodologies, encompassing importance coefficient, backward and forward-sequential, and correlation-coefficient-based methods. They apply these methods to choose 12 key feature subsets from various datasets, such as KDD-CUP-1999, BotIoT-2018, and N-BaIoT-2021. Following this, a stochastic gradient descent classifier is used to differentiate network traffic into attack and normal types. The results highlight the accuracy and potential applicability of the proposed model in IoT devices. In the paper [61], authors present a comprehensive evaluation of security vulnerabilities in WiFi (802.11) networks, focusing on the weaknesses of encryption protocols such as WEP, WPA, and WPA2. A key contribution of the paper is the introduction of the AWID2 dataset, which is specifically designed for intrusion detection in wireless sensor networks. The AWID2 dataset includes both normal and attack traffic, offering a valuable resource for developing ML-based IDS. Furthermore, authors also evaluate several ML classifiers, including RF, J48, NB, AdaBoost, HyperPipes, Random Tree, ZeroR, and OneR, all of which are trained using the AWID2 dataset. Among these, J48 performed the best, achieving an accuracy of 96.25% by utilizing 20 features. The study employs 20 out of 156 features for training the ML classifiers. However, no discussion is provided on the feature selection process. [PERSON] et al. [114] presented an ML-enabled IDS to detect attacks in IoT networks while utilizing the UNSW-NB15 dataset for building several FS-based classification models. The authors started by training the model with min-max normalization and principal component analysis, where only 10 out of 44 features were selected as an attempt to build lightweight classification models. Those records having only the selected 10 features were fed to several ML algorithms, namely XGBoost, CatBoost, KNN, SVM, QDA, and NB ML, to prepare several classifiers. The outcome of the experiments showed that almost all established classifiers achieved accuracy rates greater than 95%. However, the CatBoost-based classifier was found to take more training time as compared to all other classifiers. Moreover, KNN and SVM achieved high rates of accuracy with less training time. However, details about testing time, CPU usage, and memory consumed by the developed lightweight IDS were not taken into consideration. [PERSON] et al. [115] proposed a B-stacking FS-enabled IDS model for resource-constraint IoT networks, in which ensemble learning methods were incorporated. In the proposed approach, boosting and stacking algorithms were combined to achieve better accuracy results. The model included a level-0 learner that aims to reduce the biasness of the feature set, which is provided to level-1 for training. In addition, boosting learners are trained in parallel to reduce computation cycles and, subsequently, achieve an optimized learning rate. NSL-KDD and CICIDS2017 datasets were pre-processed using multi-collinearity, sampling, and dimensionality reduction techniques to remove the irrelevant features, select training samples, and reduce overfitting. The results showed that the proposed model used less CPU power and RAM storage to run the B-stacking model and also achieved high accuracy and low false alarm rates. Though the model was designed for IoT networks, the model testing has been performed with a dataset not relevant to the IoT environment.