Cluster Computing

https://doi.org/10.1007/s10586-022-03776-z (0123456789().,-volV)(0123456789().,-volV)

Internet of Things intrusion detection systems: a comprehensive

review and future directions
Arash Heidari1,2 • Mohammad Ali Jabraeil Jamali2

Received: 25 March 2022 / Revised: 16 June 2022 / Accepted: 3 October 2022

 The Author(s), under exclusive licence to Springer Science+Business Media, LLC, part of Springer Nature 2022

Abstract
The Internet of Things (IoT) is a paradigm that connects objects to the Internet as a whole and enables them to work
together to achieve common objectives, such as innovative home automation. Potential attackers see the scattered and open
IoT service structure as an appealing target for cyber-attacks. So, security cannot be dealt with independently. Security
must be designed and built-in to every layer of the IoT system. IoT security concerns not only network and data security
but also human health and life attacks. Therefore, the development of the loT system to provide security through resistance
to attacks is a de facto requirement to make the loT safe and operational. Protecting these things is very important for
system security. Plus, it is important to integrate the Intrusion Detection System (IDS) with IoT systems. IDS intends to
track and analyze network traffic from different resources and detect malicious activities. It is a significant part of
cybersecurity technology. In short, IDS is a process used to detect malicious activities against victims by several methods.
Besides, the method of Systematic Literature Review (SLR) is used to classify, review, and incorporate results from all
similar research that answers one or more IDS research topics and perform a detailed empirical research analysis on IDS
techniques. Furthermore, depending on the detection technique, we classify IDS approaches in IoT as signature-based,
anomaly-based, specification-based, and hybrid. Also, for the IDS approaches, the authors give a parametric comparison.
The benefits and drawbacks of the chosen mechanisms are then addressed. Eventually, there is an analysis of open
problems as well as potential trend directions.

Keywords Internet of Things (IoT)  IDS  Intrusion detection  Distribution  Security  Review

1 Introduction sensors, that monitor and gather all types of device data
and social life, are included in the IoT [5, 6]. Plus, IoT is a
The fast growth of decentralized and Internet-based tech- network of physical objects that can be monitored and
nologies like cloud computing and the Internet of Things controlled via the Internet [7, 8]. Besides, millions of
(IoT) has resulted in an explosion of information in prac- objects can be found in the IoT via a Wireless Sensor
tically every technical and commercial field today [1–3]. Network (WSN) through different types of actuators and
The IoT integrates a wide range of objects, sensors, and sensors connected to the Internet [9, 10]. IoT sensors
smart nodes that can communicate without human inter- usually have low memory, low power, battery, and network
vention [4]. Also, hardware resources, including smart limitations, so IoT data needs to be computed, stored,
accessed, and analyzed [11, 12]. Furthermore, large
amounts of heterogeneous data and objects are growing, so
& Arash Heidari
[email protected] a platform is needed to deal with all this [13, 14].
Moreover, because of the rapid growth of the IoT, its
& Mohammad Ali Jabraeil Jamali
[email protected] security has become one of the most challenging topics in
such a connected and shared system. Data and its integrity
1
Department of Computer Engineering, Tabriz Branch, can be jeopardized by malicious software, viruses, and
Islamic Azad University, Tabriz, Iran hackers [15]. Data insecurity can directly reduce the
2
Department of Computer Engineering, Shabestar Branch, security of the entire IoT, resulting in numerous dangerous
Islamic Azad University, Shabestar, Iran

123
 Cluster Computing

behaviors [16]. So, many wireless communications allow attack, jamming attack, and wormhole attack are examples
for unrestricted eavesdropping. The Intrusion Detection of these kinds of attacks [29].
System (IDS) aims to detect unauthorized computer system Also, it is important to conduct a thorough analysis of
use [5, 17]. Some of these access protection systems and the current literature and publications to simplify the use of
networks include Local Area Networks (LANs), Wireless IDSs in the IoT and to identify the shortcomings and
Personal Area Networks (WPANs), ad hoc networks, and strengths of these systems. In contrast to the importance of
Wireless Local Area Networks (WLANs). WSNs, mobile IDSs in the IoT, state-of-the-art mechanisms do not have a
phones, and Radio-Frequency Identification (RFID) are the detailed and wide-ranging Systematic Literature Review
three most common networks in the WPAN family [18]. (SLR). Therefore, this paper systematically analyses all
So, protection has become a hot topic in the IoT [19]. literature between the years 2018 and 2022. To improve the
Systemic security architectures and cryptographic security analysis, four types are conducted: (1) anomaly-based, (2)
frameworks are examples of existing security strategies signature-based, (3) specification-based, and (4) hybrid
[20]. The vulnerability of cyberattacks, including a large IDSs. Furthermore, this paper considers the analysis and
number of requests to IoT services in a short period or the evaluation of the works to categorize the current IDSs in
presence of unauthorized users on certain services, can the IoT, compare various IDS techniques, and summarize
result in catastrophic failures [21]. The IDS on these sys- the benefits and drawbacks of the examined IDSs. Then,
tems and networks can be generally categorized based on future recommendations on the implementation of IDSs in
the detection techniques used, for example, anomalies, the IoT will be prepared for researchers. One of the goals
stateful packet testing, or rule-based [22]. With the growth of this paper is to systematically examine the existing
of IoT and the growing number of cyber-attacks, several techniques in this domain. In brief, the paper’s contribu-
methods have been suggested for the IDS methods in the tions are as follows:
IoT realm [23]. Moreover, the IDS presents a vital role in
• Offering an overview of the IoT’s existing IDS
identifying and blocking various threats from accessing the
challenges;
network and providing a strong safety mechanism [24]. In a
• Providing an SLR overview of the state-of-the-art
system, the sheer volume of sensors has drawbacks, such as
techniques for IDS and other important activities in this
storage, interoperability, and scalability, whereas security
domain;
methods such as IDS could not work well because a large
• Providing a taxonomy of some techniques that are
amount of labeled data is required to perform, detect
important in IDS;
intrusions and detect new attacks [4]. By and large, to
• Outlining important areas where the discussed methods
protect IoT environments against different security threats,
can be improved in the future;
IDSs are a fundamental and essential security mechanism.
Generally, there are four main forms of IDSs. Signature- The following sections describe the structure of this
based IDS is the first type that defines characteristics for paper: the background of IoT-IDS and basic terminologies
each sort of attack that the IDS can recognize. When are discussed in Sect. 2. Section 3 provides the research
unusual activity fits the pattern, an alarm will be raised methodologies and mechanisms for the selection of papers.
[25]. This is a straightforward approach for detecting pro- Four main categories of selected IDS methods are descri-
ven attacks. The start-up phase of an anomaly-based IDS bed in Sect. 4. The results and comparisons are presented
gathers data about the identified system’s expected activi- in Sect. 5. The open issues and the conclusion part are
ties. The IDS then establishes a threshold that must be defined in Sects. 6 and 7, respectively. Also, Table 1 shows
crossed by suspicious activity for an alarm to be raised. the abbreviations used in the paper.
This system can detect intrusion attempts, but it is com-
putationally very expensive and requires a lot of memory to
analyze the data [26]. A combination of signature-based 2 Basic concepts and related terminologies
and anomaly IDS attempts to strike a balance between the
signature-based detection mechanism’s storage cost and This section will first introduce IoT architecture, the next
the computational cost and false-positive alarm problem of IDS and their approaches, and then cover the many forms
the anomaly-based detection system [27]. The specifica- of attacks. Following that, the assessment metrics and
tion-driven approach IDS defines common system activi- network structure are detailed.
ties and verifies current operations against those operations
[28]. Then, they were classified into various groups based 2.1 Architecture of IoT
on the types of threats they could identify. A denial of
service attack, sinkhole attack, replay attack, black hole Adoption of a single IoT reference model is critical for the
attack, selective forwarding attack, Sybil attack, false data progress and spread of IoT services and applications. In

123
Cluster Computing

Table 1 Abbreviation table

Abbreviation Definition Abbreviation Definition

AE Auto Encoder M2M Machine-to-Machine

BANs Body Area Network ML Machine Learning
CIDNs Collaborative Intrusion Detection Systems NIDS Network Intrusion Detection Systems
CNN Convolutional Neural Network NSA Negative Selection algorithm
DIDS Distributed IDS OPF Optimum-Path Forest
DNN Deep Neural Network PCA Patient-Controlled Analgesia
DBN Deep Belief Network PCA-GWO Principal Component Analysis-Grey-Wolf Optimization
DoS Denial-of-Service PSO Particle Swarm Optimization
DODAG Destination Oriented Directed Acyclic Graph RBM Restricted Boltzmann Machines
DT Danger Theory RPL Routing Protocol for Low-Power and Lossy Networks
DL Deep Learning (DL) RFID Radio-Frequency Identification
ECAE Elastic Contractive Auto Encoder RL Reinforcement Learning
EPC Electronic Product Code RNN Recurrent Neural Networks
ESM Exclusive Signature Matching SDN Software Definition Network
GA-GWO Genetic Algorithm and Grey Wolf Optimize SH-IDS Specification Heuristics based Intrusion Detection System
GPS Global Positioning System SLR Systematic Literature Review
HIDS Host-based Intrusion Detection Systems UDP User Datagram Protocol
IDS Intrusion Detection System UID Ubiquitous ID
IoT Internet of Things WLAN Wireless Local Area Networks
IETF The Internet Engineering Task Force WPAN Wireless Personal Area Networks
LAN Local Area Networks WSN Wireless Sensor Network

recent years, a variety of architectural solutions have been an interconnection of IT and industries by utilizing the
presented, including academic and research institutions, application layer [32]. The application layer’s key issue is
enterprises, stakeholders, and civil society organizations, as sharing of information and data security. There seems to be
well as international standard organizations such as ETSI, no generally approved IoT design at the moment. Elec-
IETF, IEEE, W3C, OASIS, and others. Manufacturing tronic Product Code (EPC) Global IoT, which is sponsored
sight is also a crucial component of IoT deployment [30]. by Europe, the U.S, and the Japanese loT system Ubiqui-
IoT can be divided into three layers: the layer of percep- tous ID (UID) is the most significant structure in the IoT
tion, the layer of the network, and the layer of the appli- [33].
cation. The layer of perception consists of a two-
dimensional code tag and code reader, Global Positioning 2.2 Intrusion detection system
System (GPS), camera, RFID tag, sensor network of all
kinds, Machine-to-Machine (M2M) terminal, and sensor IDSs are software or hardware platforms that recognize and
gateway. So, the perception layer’s primary role is to respond to computer attacks autonomously. Intrusion
observe, recognize, gather and capture data. The network response systems continually monitor system health based
layer is made up of a converged network of all forms of on IDS warnings to efficiently identify and resolve possible
communications infrastructure as well as the Internet. This events or improper behaviors. Intrusion response systems
part was widely accepted as the most mature part. Besides, use appropriate countermeasures to ensure computer
the network layer includes both the loT management center security. As a result, implementing alert protocols is a good
and the information center, implying that the network layer way to ensure that such platforms are responding optimally
ought to be able to control the networks but also increase [34]. Systems for quantitatively identifying and classifying
its potential to function information. The IoT platform attacks based on how they affect data integrity, availability,
which becomes a public utility is the network layer [31]. In and secrecy are also required. For example, if an attacker
addition, IoT and industrial experience are used to create compromises the integrity of an enterprise database system,
the application layer, which allows for a wide range of a proper reaction is required to ensure data integrity. If the
innovative applications. IoT could eventually accomplish threat is directed against the system, meanwhile, the

123
 Cluster Computing

reaction could increase resource availability and system is important for detecting attack patterns in the systems.
performance. When an intrusion is detected, an IDS sends Packets from multiple locations are collected in a packet
out an alarm in the form of a report and notice. IDS is analyzer and analyzed by an IDS engine deployed in the
ineffective without a proper security countermeasure. To network. With the highly dynamic IoT users, the packet’s
aid in locating the source of an attack, a response system threshold value may change since the continuous threshold
should be connected with IDS. Traditional IDS rules tend value is ineffective and results in inaccurate results. As a
to be static due to the static nature of the monitored sys- result, it must be flexible and dynamic in categorizing
tems, whereas node groups have steady characteristics that threat behaviors. Based on packet header information,
have been recognized through time. The monitored IoT packets are classified as normal or attacked in a packet
nodes are constantly added and withdrawn, unlike in a analyzer. The packet analyzer will examine the packets
traditional system [35]. Furthermore, the security needs of based on the packet header’s packet arrival time, packet
each IoT node vary. Also, a system administrator who is count, and packet size. Also, the attack detection compo-
responsible for the overall security of the system usually nent is in charge of identifying the node’s attack. It has its
establishes and manages the security policies. Because the decision-making process based on internal rules, heuristics,
switch is virtualized, there are further challenges with and knowledge from its knowledge base. From a huge
visibility into inter IoT traffic on a platform. As a result, number of attack patterns, the rule generation engine
traditional physical monitoring solutions are unable to component could build a few rules. As a result, an IoT
inspect this network traffic. Furthermore, the new virtual- device can be processed with the fewest rules possible to
ization systems may have vulnerabilities that may lead to a efficiently detect an attack. Attacks occur mostly in sepa-
major breach, thus they should be monitored and examined rate groups known as incidents. Outside attacks are
for configuration problems, updates, and other issues. In described as outsider attacks. Plus, insider attacks involve
conclusion, traditional solutions are unable to be deployed unauthorized internal users who attempt to gain and abuse
in IoT contexts, which have their own unique needs and unauthorized access privileges [37]. While many incidents
characteristics. There may not be a traditional IDS that can are malicious, many others are not; for example, a person
effectively satisfy these requirements [36]. So, IDS is a can mistake a computer’s address and accidentally try to
monitoring process for unauthorized entry, activity, or file connect to another system without permission [38]. So, we
modification by computers or networks. The traditional need an IoT immune system. For this reason, IDS monitors
IDS architecture in IoT is demonstrated in Fig. 1. The malicious actions or policy violations in IoT [39]. Also,
architecture has the following units, as follows: Sensor, any malicious activity or violation with an IDS was nor-
packet analyzer, attack detection, generation rules, and as mally reported or centrally collected by the administrator
output, IP tables rules, which are the generated firewall [40]. To identify malicious activity from false alerts, IDS
rules. The packet analyzer in the intrusion detection engine integrates the outputs from numerous sources with alarm
filtering mechanisms. IDS offers a variety of sizes, ranging
from single machines to big networks. The two primary
conventional classifications offered in the articles are
Network Intrusion Detection Systems (NIDS) and Host-
based Intrusion Detection Systems (HIDS). Signature-
based detection, such as recognizing harmful patterns, and
anomaly-based detection, such as finding departures from a
good traffic model, which typically relies on ML, are two
types of IDS detection approaches [41].

2.3 Kinds of attacks

The attacks can be broken down into active or passive

attacks. Plus, the attack features an attacker who tries to
break into the IoT. The intruder inserts data into the system
and potentially changes data inside the system until an
active attack is carried out. Active attack types are Denial
of Service (DoS), session replay, and masquerade dis-
tributed. Examples of active attacks are viruses, worms,
and Trojans. Moreover, the passive attack tries to learn or
Fig. 1 In the IoT, the structured layers of IDS use system information without affecting system resources.

123
Cluster Computing

Tapping, scanning, and encryption are some kinds of pas- Recall, as represented by Recall, is a metric that informs
sive attacks. An attack may also be carried out by a com- us how many real positive observations we can forecast
pany outsider or an insider. An insider attack is a malicious with accuracy. SFN also stood for all false negatives in
attack against a person with authorized system access on a Eq. (3) [45].
network or computer system. UBS PaineWebber is one
inside attack type. An outsider attack was initiated by the STP
Recall ¼  100 ð3Þ
system’s illegal use. Spoofing, spam, and spin are some of STP þ SFN
the external attack types [42]. In addition, the F1 is a composite performance mea-
surement that includes Precision and Recall. Precision and
2.4 Commonly used metrics recall are represented by the Harmonic mean.
2  ReCall  P
This section defines the most frequent assessment measures F1score ¼  100 ð4Þ
ReCall þ P
for assessing the effectiveness of IDS approaches. Appro-
priate IDS aids in improving detection accuracy, lowering In addition, the CM is an evaluating performance matrix
false alarm rates, increasing resource usage, and detecting that uses False Positives, True Positives, False Negatives,
threats with minimal latency. Some metrics are highly and True Negatives labels to compare actual and expected
important for evaluating the effectiveness of IDSs, and they observations. True Negatives and True Positives make up
are as follows: The difference between the number of the overall right forecasts, while False Positives and False
resources required before the system’s function and the Negatives make up the total wrong predictions [45].
level of resources released once the activity is completed is STP SFP
referred to as resource consumption. Also, scalability ð5Þ
SFN STN
refers to the IDS’s capacity to keep up with the system’s
evolution while maintaining relative detection accuracy True Positives are also forecasts that are both positive
[43]. The ability of a network to adapt and move forward and right for a class. True negatives, on the other hand, are
when new conditions occur is often referred to as flexibility inaccurate predictions that are negative to a class. False
[44]. The response time of a function is the latency Positives (Type 1 Error) are forecasts for a class that are
between when it is started in the system and when it is both positive and wrong. False Negatives (Type 2 Error)
finished. The cost of operating or monitoring IoT at a are forecasts of a class that are negative but incorrect.
specific period is also included in the cost. The computa- Specificity is a metric that indicates how well the target
tional complexity refers to the number of resources classes were identified in the test set. If there are 100
required to operate it. In this case, the computational positive classes in the test set and the classifier properly
complexity is the lowest of all potential difficulties for IDS identifies 80 of them while mistakenly identifying the
approaches in IoT situations. Also, IDS performance can be remaining 20, the classifier correctly identified 80% of the
measured utilizing measures like specificity, recall (sensi- real samples in the data. As a result, specificity is computed
tivity), accuracy, precision, Confusion Matrix (CM), as follows [45]:
specificity; and F1 Score. So, accuracy is specified as the Specificity ¼ ðSTN =STN þ SFP Þ  100 ð6Þ
ratio of total correctly classified observations to total pre-
dicted observations. When all values in a Confusion Matrix
are added together, the ratio of True Negatives to True 2.5 Network structure
Positives is calculated. So, accuracy is calculated as fol-
lows [45]: Based on the network structure, there are three main types
of IDS: centralized, distributed, and hybrid. The data is
STN þ STP
Accuracy ¼  100 ð1Þ examined in a fixed number of locations in a centralized
STP þ STN þ SFN þSFP
IDS, regardless of how many hosts are being tested. In
Precision is a measurement for determining the amount these structures, the IDS is configured in the border router
of confidence in forecasts. In comparison to all favorably or cluster head, which sends node traffic to the core IDS,
predicted observations, the fraction of True Positive which therefore analyzes the traffic collected by sensors to
anticipated observations. In addition, STP represents the detect intrusions [46]. In addition, the detection system in
total number of true positives, whereas SFP represents the Distributed IDS (DIDS) is installed on the sensors of IoT
total number of false positives [45]. networks, and each sensor can detect the intrusion locally
STP after collecting the environment’s traffic. A DIDS is made
Precision ¼ ð2Þ up of many IDSs in a wide network that are all linked to
STP þ SFP
each other or a central server, making it simple to track the

123
 Cluster Computing

network and investigate the occurrence of an attack [47]. 3.2 Process of article selection
The hybrid IDS is a hybrid of dispersed and centralized
strategies that takes advantage of their strengths while The papers are systematically selected through the fol-
avoiding their weaknesses. Each sensor node contains an lowing phases, including automated abstract-dependent
IDS, which can detect intrusions on a local level. Fur- investigation, publication quality, keywords, title-depen-
thermore, the border router node’s IDS can detect intru- dent paper opting, and analysis of reference and
sions globally after detecting intrusions on nodes [48]. publication.

3.2.1 Stage 1: automated search

3 Research methodology
In this section, the authors present an evaluation based on
This paper aims to offer comprehensive guidelines for SLR the SLR as a research study evaluation and an important
for researchers. The SLR is a way to evaluate and inter- evaluation for the categorization of IDS methods in IoT
pret all available research relevant to a specific research environments. The following discovery string was defined
problem, topic, or phenomenon of interest [49]. The SLR is by adding the main elements to substitutes and other syn-
designed to provide a fair assessment of a research topic onyms [51]. ‘‘Intrusion Detection’’ OR ‘‘IDS’’ OR ‘‘mali-
using a rigorous, auditable, and reliable methodology with cious detection ‘‘OR ‘‘system detection’’ OR ‘‘Anomaly
multiple IDS approaches, but few specify different IoT detection’’ OR ‘‘Attack mitigation’’ OR ‘‘artificial immune
environments. The SLR method usually contains a systems’’) AND (‘‘IoT’’ OR ‘‘Internet of Things’’).
description of the research collection [50]. Section 3.1 The distribution of articles over time was shown in
identifies carefully prepared research questions for inves- Fig. 3 based on the review process and citations of articles
tigating IDS techniques in the IoT domain. The article like IEEE, Springer, Elsevier, Taylor & Francis, Wiley, and
selection procedure is discussed in Sect. 3.2. Figure 2. ACM Table 2 also contains some electronic databases,
depicts the article search and selection method used in this including IEEE and Science Direct, which are employed in
study. SLR.

3.1 Question formalization 3.2.2 Stage 2: article selection

In this systematic review, the following Analytical Ques- In the first step, the screening criteria employed were
tions (AQ) are answered in full based on the objectives and selected to confirm high-quality publications and papers in
scope of the proposed research: the study. By searching for journal papers according to the
results obtained, the search string is limited. All other
• AQ1: What are IDS methods in the IoT realm?
groups of studies are henceforth omitted from the original
• AQ2: Which IDS platforms have been selected for IoT?
quest. To satisfy the supposed database search engine’s
• AQ3: What assessment criteria are used to assess IDS?
syntax needs, the search string uses all databases to be
• AQ4: What are the popular IDS tools used for IoT
adapted. Editorial notices, studies, reviews, non-English
modeling?
language articles, survey articles, and papers are not
• AQ5: What supports IDS with the existing IoT
included in this review. However, 75 papers were taken
algorithms?
into account to be examined.
• AQ6: What are the future and open prospects for IDS in
the IoT?

Fig. 2 The stages of the article search and selection procedure

123
Cluster Computing

Fig. 4 The distribution of the selected articles by the publishers

Fig. 3 Distribution by Publisher of research papers (updated on Feb 4 IDS mechanisms in IoT based
2022) on the detection method

Table 2 Electronic databases were used in selecting the article The selected papers are checked and the most widely dis-
cussed IDSs are listed to respond to research questions. The
Online database URL address
IoT has different types of IDSs, such as hybrid, anomaly-
Springer http://link.springer.com/ based, signature-based, and specification-based. Their
ACM http://dl.acm.org/ mechanism for finding malicious nodes, they vary. In a
Science Direct http://www.sciencedirect.com/ nutshell, an IDS is a set of protection mechanisms for
Taylor & Francis http://www.tandfonline.com/ capturing and analyzing packets in a computer network. If
John Wiley http://onlinelibrary.wiley.com/ any abnormalities are discovered after the investigation,
Emerald https://www.emerald.com/insight/ the goal is to terminate the harmful behavior and create a
IEEE http://ieeexplore.ieee.org/ history of similar actions for further network security
Scopus https://www.scopus.com/ policy adjustments. It is essential to retrieve past infor-
mation to help with defense policy adjustments, including
the form of threat, attackers’ and victims’ IP addresses,
attackers’ and victims’ IP ports, and so on. The used tax-
3.2.3 Stage 3: publication analysis onomy is designed by the detection method presented in
Fig. 5.
The authors review the selected papers to ensure the In addition, a general perspective of the IDS approaches
validity of those studies. Key elements for decision-making can be presented in Fig. 6. The model consists of four
are the subject, journal rating, and year of publication. major components as shown below.
Three levels have been refined for the selected papers. Six
notable publishers and IoT intrusion detection studies will 4.1 Anomaly-based mechanisms
be selected after the filter is used. Consequently, 24 papers
have been identified, reviewed, and analyzed. The authors This part covers the key characteristics of anomaly-based
choose a document that (1) is presented in the domain of IoT techniques. Finally, Sect. 4.1.3 refers to comparing and
IoT intrusion detection, (2) clearly describes the proposed summarizing anomaly-based mechanisms.
mechanism, and (3) considers some parameters that have
been established. Finally, among the 24 selected papers, 6 4.1.1 Overview of the anomaly-based mechanisms
publications were anomaly-based, 6 were signature-based,
6 were specification-based, and 6 were hybrid. In addition, System actions and operations against a usual behavior
Fig. 4 depicts the distribution of the selected papers by profile at once generate an alert when a deviation from
their publishers. normal behavior exceeds an anomaly-based threshold rel-
ative to IDSs. The detection of new attacks, especially
those related to resource abuse, is efficient. Anything that
does not conform to typical conduct, on the other hand, is
regarded as an intrusion, and learning the entire spectrum
of normal behavior is not an easy process. Also, this
method usually has high false-positive rates. Researchers
usually use statistical or Deep Learning (DL) techniques,

123
 Cluster Computing

Fig. 5 The taxonomy of IDS

mechanisms in IoT by detection
method

Fig. 6 The overall IDS framework in IoT, as well as its connections to other platforms, such as cloud environments

which can be too heavy for low-capacity IoT nodes, to of the system in the basic anomaly-based architecture.
create a normal behavior profile. Therefore, this feature After that, similar and new attacks are evaluated, and
should be taken into account by anomaly-based IoT net- lastly, alarms are generated.
work mechanisms [52]. The main assumption of an
anomaly-based IDS is that new attacks can be detected. 4.1.2 Review of the selected anomaly-based mechanisms
The assumption is that a new or known attack has behav-
iors that are substantially different from the use of a typical For detecting intrusions and tracking misuse behavior,
system to identify the outliers. However, incoming events anomaly-based IDS is used. Using threshold classifies this
are generally classified according to similarities with pre- behavior as regular or abnormal. These types of IDSs track
viously identified events in the training data set. As a result, the activity of a normal network in the IoT to set a
new threats can be accurately categorized if they match threshold. So, the network’s behavior is compared to the
known attacks. By definition, an unknown attack cannot threshold to detect intrusions, and any deviation from this
train a Machine Learning (ML) detection system. Con- value is considered anomalous.
trolling the events in the test dataset, on the other hand, Almalawi [53] suggested a technique for unsupervised
may be used to assess an IDS’s capabilities. A system detection called the global anomaly threshold, which is
could be taught and evaluated with a specific sort of attack, being used as an add-on element to enhance the precision
or with attacks that are similar but not identical. The def- of unsupervised IDS. At first, this was done by learning two
inition of the similarity of events depends on the context labeled small datasets from the unlabeled data, where each
and its expertise. The process is displayed in Fig. 7. Known dataset reflects whether in normal or abnormal behavior. A
attacks are kept in the cloud, fog, or edge dataset per usage collection of supervised classifiers was therefore trained

123
Cluster Computing

Fig. 7 The overall model of anomaly-based IDS in the IoT realm

with query datasets to build an ensemble-based decision- real-time regardless of the form or mark of an endpoint
making model that can then be incorporated into both event log. To determine suspicious conduct that differs
unsupervised anomaly scoring and clustering-based IDSs. from typical behavior, they employed two models. Ano-
In the former, the approach is being used to reduce the malous detection examines the event log to determine
sensitivity of the anomaly threshold, whereas, in the latter, anomaly ratings. The model detected hazards based on the
it is used to effectively identify the clusters created as anomaly score and the rules produced by the attack model.
normal or abnormal. Results showed that when integrated Besides, attack characteristics categorize attacks represent
into a clustering-based IDS as a labeling technique for the the frequency with which events happen and assess threats
produced clusters, their method showed significant and based on criteria derived from unusual activity associa-
promising outcomes. Compared to other benchmarks, their tions. The results showed, that in terms of response time,
approach demonstrated better performance and high relia- the mechanism has better detection. Additionally, for
bility. Their strategy also suffers from poor scalability and reliable anomaly detection on each endpoint system, dif-
low robustness. ferent policies can be implemented. The biggest downside
Also, Eskandari [54] implemented a technique called of the approach is that different attacks can not be
Passban, a smart anomaly-based IDS that is intentionally protected.
devised to be hosted and accomplished by a standard edge By using stochastic and evolutionary game models,
system directly. First, they designed an IoT testbed that Gothawal and Nagaraj [56] introduced anomaly-based IDS
looks like a traditional smart home automation setting. for Routing Protocol for Low-Power and Lossy Networks
Later, the IoT testbed was designed as 2 distinct scenarios (RPL). To calculate the probability of transfer, their tech-
to analyze the effectiveness of the suggested IDS in terms nique considered the stochastic game theory model and
of both threat detection accuracy and computational formulated the player interactions on control packets and
resources needed by the implementing scheme. In one, the packet routing. Besides, applying the evolutionary game
IDS is been directly implemented and performed on the model efficiently verifies the calculated likelihood of
IoT gateway: in this particular instance, Passban seemed to transformation using a synchronization algorithm. In the
be successful in gaining the latter and all IoT presence of malicious players over IoT networks, it illus-
objects connected directly to it. Utilizing two one-class trated the successful attack detection accuracy and RPL
classification methods, they used Passban and tested it efficiency. States and the observation of state change with
against four common attacks. The evaluation revealed that the awareness of RPL rules ensure the prevention of RPL
Passban IDS can provide high detection accuracy in terms success and topology-based attacks. Their method recog-
of threat detection accuracy. It also suffers from poor nized the attackers and provided the stable RPL for IoT by
scalability as well. validating the outcomes of the stochastic gaming model in
Plus, the anomaly detection method proposed by Kim the calculation of specious state transfer likelihood using
[55] is a mechanism that could be implemented and run in the evolutionary game model. High efficiency in detecting

123
 Cluster Computing

threats is the key benefit of the technique. The approach intrusions, and any deviation from this value is considered
also has high overhead computation. an anomaly. Also, Table 3 summarizes the detection
Alhakami [57] addressed the issue of anomaly-based approaches discussed based on anomalies and presents
IDS, and for the infinite bounded generalized gaussian their significant advantages and challenges.
mixture model, they established a new completely Baye-
sian-based approach. A significant feature of the estab- 5.1 Signature-based mechanisms
lished model is that it incorporated a framework for feature
selection to prevent the modeling process from being This part describes IoT signature-based methods and their
affected by irrelevant features. Also, their use of the major characteristics. Finally, Sect. 4.2.3 refers to com-
technique of Bayesian inference is motivated by the fact paring and summarizing Signature-based mechanisms.
that it helped them to avoid under- and over-fitting, for-
malize their previous information, and communicate their 5.1.1 Signature-based mechanisms
uncertainty through distributions of probability. Further-
more, the key aim of using such an infinite assumption IDS threats were identified using this method when net-
rather than the finite one is its ability to simultaneously work activity matched an attack signature contained in the
learn (for example estimation of parameters and model IDS internal databases. If any system or network behavior
selection) the parameters and many components of the fits the recorded patterns/signatures, an alarm will be
model. The integration of a feature selection method, on generated. Plus, IDSs based on signatures are accurate and
the other hand, aimed to remove redundant features and very efficient in identifying known threats and their method
take into account only the most important features, and is easy to understand. Nevertheless, since one matching
then improve efficiency in terms of accuracy. The efficacy signature for these cyberattacks is unknown whether the
of their methodology is verified by evaluating it on the platform or network activity meets an attack signature
demanding application, namely the anomaly IDS while contained in the IDS internal datasets, this technique is
comparing it to other analogous literature methods useless in identifying new attacks and variations of old
reported. attacks. An alarm is issued if any model and network
Finally, Roy [58] presented an IDS model that employed activity fit the stored patterns/signatures. Signature-based
ML to identify cyber-attacks and anomalies in resource- IDSs seem to be accurate and effective in detecting known
constrained IoT systems. The model determined the most threats, and their mechanisms are simple to comprehend.
relevant attributes to detect intrusions employing consid- Furthermore, this method fails to detect new attacks and
erably fewer training data and less training time thanks to a known variations since a matching signature for these
combination of optimizations that include the removal of assaults has yet to be discovered [52, 59]. Also, Fig. 8
multicollinearity, sampling, and dimensionality reduction. represents the overall model of the signature-based
Comprehensive studies were conducted on the NSL-KDD approaches in IoT that consists of four components: IDS
and CICIDS2017 databases to assess the method. The engine, cloud database, signature extraction, and signature
findings of their system on different datasets revealed that matching phase. The IDS engine extracts signatures first,
it has a low false alarm rate and high detection rate. It then compares them to the database for signature matching.
surpassed previous systems across several performance After that, an output and an alert are created.
parameters and is consistent in identifying serious cyber-
attacks. Most notably, in contrast to typical resource-in- 5.1.2 Review of the selected Signature-based mechanisms
tensive IDS, the suggested system is lightweight and could
be installed on IoT devices with limited power and After decades of growth in both academic and industrial
memory. research, signature-based identification schemes play a key
role in protecting against various attacks. It is based on the
assumption that the signatures of different attacks are
5 Summary of the reviewed anomaly-based usually unchangeable, and that since the number of mali-
mechanisms cious patterns is small, they could be detected early on.
Signature-based detection methods compare the network’s
Anomaly-based IDS is being used to detect intrusions and current activity to known attack trends. Signatures are first
monitor the operation of misuse. This behavior is catego- assessed and stored on the device in the IoT, and each
rized as normal or abnormal by the use of a threshold. In signature corresponds to a specific attack. Signature-based
the IoT, to establish a threshold, these kinds of IDSs will approaches are commonly used and require a signature for
monitor the behavior of the normal network. The network each attack. The rest of this section is a review of the
behavior is correlated with the threshold to detect the selected papers in this area.

123
Cluster Computing

Table 3 Discussed an Anomaly-based approach and its properties

Detection method: anomaly-based
# Authors Main idea Advantages Challenges Placement Validation Architecture
strategy strategy

1 Almalaw Proposing the global anomaly threshold High reliability Lack of Centralized Simulation IoT
[53] for unsupervised anomaly density High elaborate
technique-based detection performance evaluation of
traditional
attacks
Poor scalability
Low robustness
2 Eskandari Presenting a platform-independent Improving the It is not Hybrid Implementation IoT-Edge
[54] anomaly-based IDS that operates detection appropriate for
directly on the edge efficiency a realistic
High accuracy scenario
High latency
3 Kim [55] Proposing a method for identifying risks The distributed Different attacks Distributed Simulation IoT
based on the attack profile’s generated IDS problem can not be
rules and the anomaly score of IoT is detected
resolved
Low detection
time
4 Gothawal Proposing a method for using stochastic High High Hybrid Simulation IoT
and and evolutionary game models to performance computation
Nagaraj achieve greater accuracy of detection in detecting overhead
[56] threats High
complexity
5 Alhakami Learning the patterns of the activities via High accuracy Poor scalability Hybrid Simulation IoT
[57] a Bayesian-based inference for infinite High efficiency High latency
bound Gaussian generalized mixture
models
6 Roy [58] Presenting an IDS model that employs High detection Weak Centralized Python IoT
ML to identify cyber-attacks and rate robustness
abnormalities in resource-constrained A low false High memory
IoT networks alarm rate overhead

Fig. 8 The overall model of signature-based detection in IoT

123
 Cluster Computing

On signature-based detection, Li [60] created a general computing time consumed during the signature creation
architecture for collaborative signature-based blockchain and verification procedures. The system is built based on
IDSs that uses blockchains to gradually share and construct the suggested modified interactive quadratic waste concept
a trusted signature database. Their strategy used block- and is seen to be existentially unforgettable. Moreover, to
chains to maximize the efficacy of collective IDSs based on evaluate its security, the scheme does not rely on the ran-
signatures. Their approach focused primarily on signature- dom oracle model. The overall analysis concluded that
based detection, which, in comparison to anomaly-based their scheme in various cloud-IoT environments is versa-
detection, has a larger application in practice. Anomaly- tile, effective, and reliable. Since most smart devices have
based IDSs frequently generate a large number of false recently had low storage space, their framework suffers
alarms due to the difficulties of creating an appropriate from high overhead.
profile. They aimed to explore the feasibility of the use of Also, Otoum and Nayak [64] presented a signature-
blockchain in Collaborative Intrusion Detection Systems based IDS replacement approach. Traffic filtering, prepro-
(CIDNs) and to encourage more research into the design of cessing, and IDS are the three steps discussed here. The
robust CIDN signature sharing. Their approach showed IoT gateway extracts and validates the characteristics of the
high efficiency and elevated robustness. It also suffers from arriving packet streams during the traffic filtering step. The
poor scalability and limited accuracy. characteristics are translated into numeric values, normal-
Also, Li [61] proposed a two-stage AI-based IDS ized, and redundancy is removed during preprocessing. The
implemented on IoT networks. It leveraged the Software- network traffic with the dataset is concentrated via pre-
Defined Network (SDN) that contributes to global status processing. The traffic packets subsequently enter the sig-
monitoring as well as traffic capture. To diagnose inno- nature-based IDS phase, in which the LightNet algorithm
vative intrusions with a self-learning skill, combines and and signature matching are used to apply signature-based
coordinates two steps of IDS, involving flow classification IDS. The anomaly-based IDS examined all unknown
and feature selection. To choose optimal features and packets, and the deep Q-learning system classifies attacks
design network flow classification techniques, they using SNR and bandwidth. The developed model outper-
enhanced the bat algorithm by improving the RF algorithm. formed existing IDS approaches once the results were
In achieving higher precision and lower overhead, the analyzed.
results validate the optimality of their algorithms. Their Finally, Dı́az-Verdejo [65] presented a methodology to
results also showed that without much time consumption, better understand the ramifications of employing prede-
the device improves its detection capability. Also, their termined rulesets in signature-based IDS performance.
mechanism Inefficiencies in large and complex networks. They tested the effectiveness of three signature-based IDSs
Plus, Meng [62] suggested a single character frequency- in the context of web attacks. Utilizing seven attack data-
based Exclusive Signature Matching (ESM) allowed sets, they measured the detection rate obtained with pre-
blockchain, which can create a verifiable database of determined subsets of rules for Snort, ModSecurity, and
malicious payloads through blockchains. The single char- Nemesida. They also used a big trace from a public website
acter frequency-based ESM can be used to protect the to determine the precision and rate of alarm issued by each
smart environment to enhance the process of signature detector in a real-life instance. The maximum detection
matching for collective IDS. Plus, such an ESM method rate attained by the model under evaluation is insufficient
can be vulnerable to hostile environments, i.e., under to properly safeguard systems and is lower than predicted
character padding attacks. They concentrated on this for recognized attacks, according to the studies. The choice
challenge and suggested a single character frequency-based of preconfigured settings active on each detector also has a
ESM that is blockchain-enabled. Their findings validated significant impact on its detection capability and false
that, in most situations, PackSig observation always holds alarm rate, according to the findings. Ultimately, they
and that the output of single character frequency-based presented an effective approach for systematically evalu-
ESM in a hostile network may be degraded. The findings ating which rules in a ruleset should be deactivated to
also showed that their blockchain-enabled system, by lower the false alarm rate in a target environmental context.
reducing the incidence of worst cases, will increase the
robustness of the original system.
By using the Jacobi symbol, Kumar [63] provided an 6 Summary of the reviewed signature-based
IDS-based authentication protocol method. High compu- mechanisms
tational bilinear pairing procedures are not supported by
the suggested methodology. In addition, their technique is Table 4 summarizes the discussed signature-based detec-
more computationally efficient than competing ones when tion methods and introduces their important advantages
compared to other comparable methods in terms of the and challenges. In contrast with anomaly-based methods,

123
Cluster Computing

Table 4 Discussed the Signature-based approach and its properties

Detection method: signature-based
# Authors Main idea Advantages Challenges Placement Validation Architecture
strategy strategy

1 Li [60] Proposing a blockchain-based architecture High Cannot cover Distributed Implementation IoT
through the combination of blockchains efficiency all of the
in an IoT High various
robustness threats
Low accuracy
poor scalability
2 Li [61] Proposing an advanced IDS using DL Lower Inefficiencies Distributed Simulation IoT
algorithms based on SD-IoT overhead in large and
architectures computation complex
High networks
accuracy
Suitable for
devices
with low
power
3 Meng [62] Combining blockchain technology in IoT High Poor scalability Distributed Simulation IoT-cloud
with single-character frequency- robustness High
dependent ESM High Security complexity
4 Kumar Proposing a quadratic residue-based High High overhead Distributed Implementation IoT-cloud
[63] signature pairing-free method that Reliability High delay
authenticates IoT devices and cloud- Strong
centered data security
5 Otoum Providing a Q-learning IDS architecture to Low High energy Distributed Python IoT
and address the shortcomings of signature- overhead consumption
Nayak based IDS Low delay Low robustness
[64]
6 Dı́az- Employing predefined ruleset settings in High High response Distributed Simulation Distributed
Verdejo the scope of SIDS that identify URI web precision time environments
[65] attacks Reduce false
alarms

due to their lower false alarm rate, signature-based detec- 6.1 Specification-based mechanisms
tion also has a broader acceptance. While the signature
matching process is a significant bottleneck, in which the This section is about the specification-based methods of
workload is at least linear to the target string size. The IoT as well as their main features. Lastly, Sect. 4.3.3 refers
signature-based detection method plays an important role to comparing and summarizing specification-based
in taking an important place in industrial and academic methods.
research after decades of development to protect against
multiple attacks. It is based on the idea that because the 6.1.1 Overview of the Specification-based mechanisms
number of harmful patterns is restricted, the signatures of
diverse assaults are typically unaltered and may be iden- The specification is a system of principles and thresholds
tified at an early stage. Signature-based detections compare that govern how network elements like protocols, nodes,
current network activity to pre-defined attack patterns. and routing tables should behave. Specification-based
Signatures are first discovered and stored on the device in methods have been used to identify intrusion when network
the IoT, and each signature is then matched to a specific activity differs from specification specifications [66]. So,
threat. Methods commonly based on signatures are simple specification-based detection aims to achieve the same
to use, requiring a signature for each attack. objectives as anomaly-based detection: to discover devia-
tions from normal [67]. There is a fundamental distinction
between both techniques: with specification-based

123
 Cluster Computing

techniques, a human expert manually specifies the princi- off-device mode. Their tested strategy has high efficiency
ples of each specification. When opposed to anomaly-based and suffers from poor scalability.
detection, manually generated requirements generally Also, specification-based misconduct detection for the
result in reduced false-positive rates [68]. However, spec- IoT realm is suggested by Choudhary [71] which could be
ification detection units do not require a training phase, as extended to realistic IoT-embedded cyber-physical systems
they can start working immediately after the specification for very lightweight embedded IoT devices that are an
has been set. Even though manually defined specifications integral part of the overall system architecture. With a
cannot be adapted to different environments and can take Patient-Controlled Analgesia (PCA) interface embedded in
time and be prone to errors [69]. Also, the overall system a medical cyber-physical system where a peer PCA plays
architecture of specifications-based is demonstrated in the function of a monitor node, they demonstrated the
Fig. 9. This sort of architecture, as shown in Fig. 9, is feasibility of their procedure. In terms of low run time,
generally made up of an analysis engine, a specifications computation overhead, memory, and high misbehavior
database, and an IDS engine for generating alarms. These detection prediction accuracy, they placed their behavior
architectures can be deployed at the edge or in the fog, rule specification-based misbehavior detection method as
depending on the application. the only feasible solution to ensure the security of resource-
constrained embedded IoT objects against zero-day attacks.
6.1.2 Review of the selected Specification-based The technique also suffers from low response time and
mechanisms high complexity.
To detect attacks at the device level, Siu and Panda [72]
The specification-based IDSs are being discussed in this developed a specification-based algorithm. Two false data
section. Specification-based and anomaly-based IDSs are injection attack vectors were formulated that targeted the
identical in the IoT since they both detect intrusions when a automatic generation control and frequency measurement
deviation from normal behavior occurs. So, Sharma [70] signal, and a risk assessment was carried out. In addition,
suggested a Behavior Rule specification-based IDS in IoT studies were conducted on a model of a three-area power
called BRIoT. For any embedded IoT device, BRIoT can grid, and findings showed that in different situations, the
formally verify the correctness of behavior rules and col- algorithm was able to detect false data injection attacks.
lect/analyze compliance data for detection of misconduct. Besides, to establish a digital forensics technique, the
BRIoT is particularly applicable to mission-critical CPSs knowledge obtained by this detection algorithm will be
with defined security specifications, irrespective of whether used. Their method can be useful for finding the source of
the attacks are known or unknown since it detects the the attack, monitoring the attack signal, and restoring any
misconduct of an IoT system as a result of attacks. BRIoT data loss, enabling mitigating measures to be in place to
was developed as a tool that enables a user to define an restore the system’s service. Their method benefits from
embedded IoT device’s operational profile as an input. The high robustness and high availability but suffers from poor
tool then created a set of security requirements and a set of scalability.
behavior rules automatically, checks the correctness of the Babu and Reddy [73] proposed the ‘‘Specification
produced behavior rules, and turns the behavior rules into a Heuristics based Intrusion Detection System (SH-IDS)’’ as
state machine for detecting misbehavior during runtime. a model for defending IoT network intrusion. The model,
The overall operating cost is very low and in three potential known as specification heuristics for positive and negative
cases, i.e. non-localized residuals, localized residuals, and labels, is depicted as a specification form. The proposed
unavailable residuals, it can be run both in on-device and scale makes it possible to predict which IoT networks

Fig. 9 The overall system architecture of specifications-based

123
Cluster Computing

would be vulnerable. The approach for defining specifica- 7 Summary of the reviewed specification-
tion heuristics depicts special n-gram sequential patterns of based mechanisms
values for sequential patterns of characteristics from both
positive and negative mark records. The method SH-IDS is Table 5 summarizes the discussed specification-based
highly significant, according to the experiment, because it detection methods and introduces their important advan-
has a detection accuracy of more than 91%, which is sig- tages and challenges. In the IoT, IDSs based on specifi-
nificantly higher than benchmarks. In addition, as com- cation and anomaly are identical since both consider
pared to other benchmarks, the energy and memory intrusions when a deviation from usual behavior occurs.
consumption overheads observed from the model SH-IDS Specification-based methods, however, do not rely on
are minimal and linear. The main drawback of the system techniques for ML. Specifications are created manually and
is poor scalability and low robustness. valid device activities are captured in these schemes.
Plus, Violettas [74] developed an IDS approach for RPL
with various profiles to address the aforementioned con- 7.1 Hybrid mechanisms
cerns, which mitigated at least 13 attacks. They proposed a
software IDS that provides a comprehensive way to protect This section discusses IoT hybrid mechanisms and their
an RPL-based IoT network from various forms of threats. main characteristics. Finally, Sect. 4.4.3 refers to compar-
Their approach is influenced by the SDN model, in that it ing and summarizing hybrid mechanisms.
offloads computational and communication costs by
transferring functionality from constraining end nodes to 7.1.1 Overview of the hybrid mechanisms
central premises, i.e., the controller. Other options go up to
eight at the same time. The solution, which is built on the This method makes use of signature and anomaly-based
network softwarization concept, provided an expandable detection principles to maximize their benefits while min-
workflow that includes four RPL specification-based pro- imizing their drawbacks. As stated above, new attacks are
cesses, an attacker identification procedure, and several continually updated by the signature-based IDS and they
attack mitigation strategies. Their system also included an do not detect a new attack. Especially problems with the
adjustable control and monitoring protocol, which trades IDS misuse can not be updated with every new type of
overhead for accuracy based on network conditions. The attack. The second method is anomaly-based IDS, which
proof-of-concept studies indicated that the technique has a identifies new attacks and unknown attacks. The first
minimal overhead for the various modes of operation it advantage of anomaly detection is that the database is not
supports, reaching up to 30% less than competing methods. required to update the data, because the usual profile
At the same time, it keeps power usage to a manageable databases are constantly maintained to detect unknown
level. attacks (or null-day attacks). The third approach is to
Finally, Santos [75] presented an IP flow-based IDS employ hybrid IDS, whereby detects signatures as well as
architecture for real-time monitoring and protection of IoT anomalous techniques, to increase IDS performance and
networks from possible attacks. Instead of employing potential at the moment. A detailed view of the hybrid IDS
packet header fields and their payload, the suggested framework can be found in Fig. 10. The hybrid framework,
scheme gathers IP flows from an IoT system and analyzes as illustrated in Fig. 10, is made up of various components,
them to monitor and identify attacks, intrusions, and other including a correlation module, a signature-based module,
sorts of abnormalities at different IoT architectural levels feature extraction, and a decision-making system. To detect
depending on specific flow attributes. The framework was threats, these components operate together. Depending on
created with both the IoT network architecture and other their function and the settings in which they are utilized,
IoT contextual features in mind, including adaptability, such frameworks may include a variety of components and
diversity, compatibility, and the efficient use of IoT net- elements.
work resources in mind. The system is network-based and
has a hybrid design, including components for both cen- 7.1.2 Review of the selected hybrid mechanisms
tralized analysis and distributed data collecting. The
scheme employed a specification-based method based on The anomaly-based IDS uses a training process to achieve
standard traffic standards for detection. The findings indi- a high detection rate when detecting a node’s normal
cated that the approach can detect intrusions and abnor- actions. Anomaly-based IDS has a high false-positive rate
malities with 100% accuracy and 0% false positives. and high computing costs, whereas signature-based IDS
has a high storage cost and a low number of attack
detections. Then, to address the shortcomings of both

123
 Cluster Computing

Table 5 Discussed the Specification-based approach and its properties

Detection method: specification-based
# Title Main idea Advantages Challenges Placement Validation Architecture
strategy strategy

1 Sharma[70] Proposing a method to define an embedded High efficiency Poor Distributed Simulation IoT
IoT device’s operational profile as an Low cost scalability
input
2 Choudhary Proposing lightweight specification-based High accuracy High Hybrid Simulation Healthcare-
[71] misbehavior management Low overhead complexity IoT
Low
response
time
3 Siu and Developing a technique based on High robustness Poor Distributed Simulation MEC
Panda requirements to detect false data High availability scalability
[72] injection attacks
4 Babu and Using heuristics-based specification IDS in High accuracy Low Distributed Using the IoT
Reddy the IoT realm Low energy robustness simulator
[73] consumption Poor CUPCORBAN
Low memory scalability
usage
5 Violettas Proposing a software IDS-inspired SDN Low overhead Low Hybrid Cooja IoT
[74] that provides a comprehensive way to High accuracy availability
protect an RPL-based IoT network from Low
Low energy
various forms of assaults scalability
consumption
6 Santos [75] Introducing a paradigm for IDS in IoT Lower High Hybrid Python IoT
systems for detecting internal or external computational complexity
attacks in real-time resources
usage
High accuracy

Fig. 10 Hybrid framework in general

systems, a hybrid scheme is presented. The signature-based resources. Many of them have a significant lag. The rest of
method was used to identify known attacks in the hybrid this section is devoted to a review of the selected articles.
scheme, while the anomaly detection method was used To minimize wireless traffic, which is the key issue
when an unknown attack was detected. Some hybrid IDS facing IDS, Davahli [76] proposed a hybrid intelligent
have high computational overhead and consume a lot of method using a Genetic Algorithm (GA) and Grey Wolf

123
Cluster Computing

Optimize called GA-GWO. In designing the IDS model in sinkhole attacks and selective forwarding, the ability of the
the IoT realm, the hybrid method using the benefits and model was investigated. Furthermore, the potential of
good features of GA and GWO attempted to intelligently blackhole, rank, and wormhole attacks was examined in the
classify the most informative wireless traffic for the help suggested model. The proposed model analyzes the traffic
vector machine classifier. Moreover, by removing obsolete and non-traffic-related characteristics of host nodes in the
and obsolete traffic data, the dimensionality of the intrusion detection module based on specifications. Local
tremendous wireless traffic data has been reduced and the results were then sent via data packets to the root node. In
computational complexity of the IDS has subsequently particular, the objects in 6LoWPAN are usually restricted,
been reduced. It is also important to remember that the IDS so the proposed specification-based IDS is a light IDS
output is kept the same or has been marginally worse after agent that eliminates the results of the local analysis after it
removing the vast number of functions. The findings is sent to the root node. The anomaly-based IDS projected
revealed that their method dramatically decreased compu- some anomaly detection models using the traffic-related
tational time with high precision and offers superior effi- features extracted from the incoming data packets based on
ciency. Besides, results have shown that the mechanism an unsupervised Optimum-Path Forest (OPF). According to
suffers from low scalability and robustness. the local and global results of IDS agents based on speci-
To identify the attacks, RM [77] suggested a hybrid fications and anomalies, the root node made a general
PCA-GWO based Deep Neural Network (DNN) Classifier decision on the anomalies that occurred in the network
Model. Their approach may be better suited to the medical using a voting system.
IoT environment in which smart medical objects commu- Moizuddin and Jose [80] suggested an IDS based on the
nicate with each other using unique IP addresses based on Generalized Mean GWO algorithm with stacked Elastic
the network. The data created is too big and DNN-based Contractive Auto Encoder (ECAE). The approach detects
methods will best manage it. The approach helps to mini- intrusions in 2 steps: feature extraction and classifications.
mize the number of characteristics and instances derived by The GMGWO method used in their study is proven to
the use of the DNN model for the classification process. choose appropriate features for training the classifier
The results showed high accuracy and the time needed for model. The study also introduced ECAE, which combines
the classification model to be trained was low. Also, the the advantages of lasso and ridge regression. When eval-
mechanism suffers from high complexity. uated on two datasets, the classifier model outperformed
Also, Li [78] proposed semi-supervised learning and state-of-the-art methods in terms of binary and multi-class
collaborative IDS architecture by applying a semi-super- classification performance measures. The suggested model,
vised learning algorithm based on disagreement. In par- which showed to be accurate using optimal subsets of
ticular, they invented a simple semi-supervised learning features from two separate datasets, is suited for existing
algorithm based on disagreement and investigated its traffic situations with thousands of characteristics.
intrusion detection efficiency. Besides, it is important to Finally, to detect threats at a faster speed, de Souza [81]
deploy collaborative IDS to secure the distributed ecosys- introduced an IDS architecture that operates on the fog
tem due to the existence of IoT networks. The method was layer. Some methods employed different learning methods
further developed to explore the use of semi-supervised and selected the one with the best performance. To achieve
disagreement-based learning in the aspects of detection good accuracy, others sought to modify the hyper-param-
enhancement and alarm filtration. In the assessment, two eters of a model. There are ML issues, though, that even
experiments were carried out specifically to study success the best model is not accurate enough. To reduce the
with datasets and in a real IoT system, respectively. Their instability of the models, it is necessary to combine models
findings suggested that by using unlabeled data in the using hybrid mechanisms. To compose the first stage of the
training phase, the disagreement-based approach could two-stage detection system of the architecture presented,
perform better than conventional approaches in terms of they also suggested a hybrid method of binary classifica-
both detection efficiency and false alarm reduction. The tion with high precision and recovery rates. Performance of
results from the experiments showed that insiders and the suggested binary classifier over existing methods of
cyber-attacks in IoT are high-performance simultaneously. ML. These findings indicate that the technique has high
Also, the mechanism suffers from poor scalability and has precision, limited use of memory, and less processing time.
vulnerabilities to different data characteristics. Besides, it The process, however, suffers from high complexity.
is vulnerable to advanced insider attacks.
Plus, to overcome the problems of the previous method,
a real-time hybrid IDS framework was based on anomaly
and specification-based IDS proposed by Bostani and
Sheikhan [79]. In detecting two IoT insider attacks, named

123
 Cluster Computing

8 Summary of the reviewed Hybrid 9 Results and comparisons

mechanisms
The examination of IDS methods for IoT is still develop-
Hybrid IDSs mostly is developed to overcome the disad- ing, the authors observed. A broad variety of attacks and
vantages of signature, anomaly, and specification-based IoT technologies are not protected by the suggested solu-
detection. Also, most of these approaches suffer from high tions. Besides, it is not clear which process and placement
complexity. Table 6 summarizes the discussed hybrid strategies of detection are more suitable for IoT systems.
detection approaches and introduces their important This paper provided a comprehensive taxonomy and
advantages and challenges. advanced IDS to consider IoT IDS solutions for research-
ers. Particular attention was paid to the characteristics of
IoT devices and the current challenges of banning the IoT
IDS extension. For this reason, firstly, the authors selected
24 articles in Sect. 3 and then reviewed the selected papers

Table 6 Discussed the Hybrid approach and its properties

Detection method: hybrid
# Authors Main idea Advantages Challenges Placement Validation strategy Architecture
strategy

1 Davahli Proposing to developing a bio- High precision It is still Distributed Simulation IoT-WSN
[76] inspired hybrid method called High efficiency susceptible to
GA–GWO various
threats
Low scalability
Low robustness
2 RM [77] Proposing a DNN Classifier Model High accuracy High Distributed Simulation Healthcare-
based on the hybrid PCA-GWO Low detection complexity IoT
to identify attacks time High energy
consumption
3 Li [78] Proposing a semi-supervised High performance Low scalability Distributed Simulation IoT
learning algorithm based on High accuracy vulnerabilities
disagreement, which can use the to different
unlabeled classification data data
characteristics
Vulnerable to
advanced
insider
attacks
4 Bostani and Proposing IDS based on the Can run on a High Hybrid Simulation IoT
Sheikhan MapReduce architecture distributed space complexity By C#.Net
[79] in parallel Low scalability programming
This can lead to a
substantial
reduction in
communication
costs
5 Moizuddin Proposing an IDS in the form of a High accuracy High energy Hybrid MATLAB ? NSL- IoT
and Jose two-stage design, with selecting Low delay consumption KDD and BoT-
[80] features conducted by a IoT
-Low complexity
GMGWO and an ECAE
6 de Souza Proposing a high-precision and Low memory High Hybrid Simulation IoT-Fog
[81] recall a hybrid system of binary usage complexity By Python
classification Low processing High energy
time consumption
High accuracy

123
Cluster Computing

in Sect. 4 that proposed special approaches of IDS for the significant impact on the cloud server’s CPU and RAM
IoT area based on SLR goals. The papers between 2018 use. Using a separate IDS server to detect attacks from
and 2022 were published. Although, the authors presented within the virtual machine in cloud computing is quite
a classification to categorize selected papers, which is tough (IDS server placement outside the cloud server). An
dependent on the considering properties: (1) IDS place- IDS server must be installed on the cloud server to detect
ment strategy (2) detection method (3) main ideas (4) cloud computing threats. Considering such attempts, the
challenges (5) advantages, and (6) validation strategy. majority of IoT IDS systems are centralized, in which
Also, the authors perceived that the research of IDS devices transfer their local data to cloud data centers or
mechanisms for IoT is still in the initial stage. The put servers with significant processing resources, where it is
forward solutions do not envelop a vast scope of attacks analyzed using ML/DL methods. Such a scenario poses
and IoT platforms. It is because of that many attack several important considerations that must be considered.
methods have become complex more than before and it Firstly, end users may be concerned about the leak of IoT
requires advanced and smart techniques such as ML devices’ local data since an attacker may deduce users’
methods for dealing with new attacks. Besides, almost it is daily activities by examining the traffic of their gadgets,
not obvious which placement strategies and detection such as wearables. Such an element might potentially be
methods are enough for IoT platforms. Finally, validation problematic for a business if nodes exchange network
strategies are not a well effective or coherent whole. In the traffic with third parties. Secondly, given the dynamics of
following, the authors briefly describe a summary of the typical IoT systems, the time necessary to notice a possible
above-mentioned methods. attack might become a critical feature (or a limiting factor
IDS server placement is a critical success factor for if computation time is significant) in preventing its prop-
attack detection. In the centralized configuration, IDS agation in a system. It could be especially important to
examines all traffic that enters and exits the border router offer early detection of generic malware used to take over
from the associated IoT objects. The downside of the weak IoT systems and quickly propagate to construct
centralized deployment technique is that it does not detect botnets. In the event of employing conventional cloud
threats within internal IoT environments. The IDSs in the datacenters, the delay resulting from communicating a
dispersed deployment technique are scattered among the significant amount of data with datacenters may be costly
network’s numerous IoT objects. Because of the resource or may reduce the efficacy of the IDS placement. Though
constraints of the IoT network, each system should be current techniques advocate the use of edge/fog comput-
designed separately, and the IDS must be lightweight. The ing, to balance computational resources in IDS deploy-
centralized and dispersed placement strategies are com- ment, such a method still creates privacy problems because
bined in the hybrid IDS placement. It focuses on the ben- device data is shared with other individuals, namely,
efits of both strategies while avoiding their drawbacks. edge/fog nodes. Thirdly, numerous IoT applications
Distributed IDS is made up of two or more IDS points include resource-constrained objects connecting via wire-
spread throughout a network(s) that communicate with one less networks with restricted throughput and bandwidth.
another. A centralized IDS is used in certain dispersed Regular transfer of device network data may constitute a
systems to oversee the other security systems deployed in significant overhead for IoT systems with a large number
other IoT systems on the same system. In a distributed IoT of linked objects. Furthermore, despite the potential bene-
MEC context, distributed IDS functions through a mecha- fits of using ML methods to enhance IoT IDS methods, the
nism of cooperative smart applications deployed over the majority of such ML-enabled IDS implementations are
network. Because of the limited resources available in IoT, centralized, with a single entity receiving network traffic
distributed data-flow programming models are employed to data from many objects to train a specific ML model. As a
create IoT applications on the MEC system. The IDS is at result, this entity has access to the entire network traffic
the center of the centralized approach based on the MEC resulting from the communication of the multiple
platforms. Most network system administrators use cen- objects participating in the training process, as well as the
tralized placement tactics and deploy intrusion detection local data of the devices. That might lead to privacy
systems in the border router. Monitoring network infor- problems. Because of the volume and sensitivity of data
mation that passes via the border router, on the other hand, shared through specific objects, including wearable or
is insufficient for detecting assaults involving IoT devices eHealth systems, this problem may be worsened in IoT
on the network. The scientists must next design an IDS - systems; hence, decentralized data management methods
that can analyze the communication between IoT objects. are critical.
IDS could be deployed independently of IoT, edge, fog, or Our findings, as shown in Fig. 11, reveal that detection
in a cloud server. The positioning of the IDS in the cloud accuracy is high in 14 of the 24 publications examined.
server and the cloud server’s separate placement has a Consequently, detection accuracy has the highest rating,

123
 Cluster Computing

false alarm rate can be reduced for unknown and known

attacks [84]. Also, signature-based approaches are intro-
duced to provide appropriate detection results for identi-
fied, specified, and well-known attacks. Although new
unknown intrusions cannot be detected, even if they are
constructed as minimal variants of already known attacks,
as well as anomaly-based attacks have a big advantage over
signature-based attacks: they can detect threats for which
no signature exists yet, including zero-day attacks. Curi-
Fig. 11 The parameters in the papers were evaluated
ously enough, these claims are not empirically supported in
the literature [85].
but scalability has the lowest. Flexibility is ranked second,
The specification-based provides the desired behavior of
and energy consumption is ranked third, while false posi-
a system through its functionality and the use of security
tive, robustness, and complexity are ranked lowest. This is
policy. Any sequence of operations carried out outside the
normal because anomaly-based approaches have a high
specifications of the system is regarded as a security breach
false-positive rate. All of the papers in the signature-based
[86]. To maintain high precision detection while reducing
techniques have high detection accuracy because signature-
the costs of defining the requirements manually, specifi-
based detection can identify specific attacks. However, in a
cation-based methods have been integrated with an auto-
real-world IoT setting with a variety of other attacks,
mated reaction or combined with anomaly-based methods.
detection accuracy plummets. Because of the complexity
The cost of defining the specifications was always a barrier
of computation, 77% of the papers in the hybrid IDS are
to extending the IDS application beyond some protocols
real-time, and 21% are about resource consumption; thus,
based on specifications [87]. So, specifications-based
we can assume that the hybrid scheme’s resource con-
methods are similar to the detection of anomalies because
sumption is high. 61% of studies in the specification-based
they detect attacks as abnormalities. Also, contrary to ML
IDS have good detection accuracy, but the majority of
approaches, specification-based approaches are based on
them have a high false-positive rate and resource usage.
manually developed specifications that capture legitimate
Furthermore, as seen in Fig. 12, 43.8% of the simulations
system behavior. They avoid the high rate of false alerts in
were performed in the Cooja environment, 28.1% in
the anomaly detection approach due to legitimate but
Python, 12.5% in NS-3, 9.4% in MATLAB, and the
unseen behavior. However, their downside is that it may
remainder were theoretical.
take time to develop detailed requirements. Therefore,
Besides, anomaly detection is concerned with the iden-
trade-off-based development efforts must be made to
tification of events that appear anomalous concerning
achieve higher false negative values [88].
normal system behavior. A wide range of techniques,
The hybrid approaches combine the positive character-
including hidden Markov models and statistical modeling,
istics of both IDSs to achieve greater detection accuracy,
have been investigated in different directions to address the
lower false alarms, and thus an increased cyber trust [89].
problem of anomaly detection [82]. The anomaly-based
Usually, hybrid detection systems train and abuse a
approach involves data collection for legitimate user con-
detection model and an anomaly detection model sepa-
duct over a period and then the use of statistical tests to
rately, then aggregate the findings [90]. For example, if at
determine whether or not this behavior is legitimate [83]. It
least one of the two models categorizes a traffic connection
has the advantage that attacks not previously identified
as an attack, Hybrid IDS considers it an attack. The
have been detected. The key element for using this
detection rate has improved in this scenario, but the IDS is
approach efficiently is the generation of rules so that the
still prone to false positives. False alarms are decreased,
but many attack connections might be ignored if the hybrid
technique considers an attack only when both models
identify the link as an attack [91]. Furthermore, our
statistics as shown in Fig. 13 that the IoT environment is
the most extensively used in papers for IDS usage,
accounting for 56% of all papers and being used in almost
every category. Also, cloud-IoT systems ranked second in
the papers with 16%. Furthermore, medical-IoT is the third
most regularly utilized context in these studies, accounting
Fig. 12 The distribution of different simulation environments used in for 8% of the total. Moreover, as demonstrated in Fig. 14,
IoT-IDS when it comes to placement strategy analysis, distributed

123
Cluster Computing

Fig. 15 Analysis of datasets in reviewed publications and their

frequency
Fig. 13 The frequency of environments is utilized in IoT-IDS
samples. It records 80 characteristics and saves them as a
pcap or CSV file for statistical evaluation. Also, Kyoto
2006 ? used honeypots, darknet sensors, email servers, a
web crawler, and other network security measures to col-
lect network traffic records for the Kyoto 2006 dataset.
From 2006 through 2015, the most recent dataset contains
traffic statistics. Each record includes 24 statistical attri-
butes, 14 of which are obtained from the KDD Cup’99
dataset and the other ten are optional.
Fig. 14 Analysis of placement strategies in reviewed publications and In addition, when it comes to ML and DL approaches,
their frequency they are widely utilized in the IoT-IDS domain. Convolu-
tional Neural Networks (CNNs) are a type of DL structure
ranks first with 53%, hybrid ranks second with 37.5%, and that is better suited to data stored in arrays. It has an input
centralized ranks last with 8.3%. layer, a feature extraction stack comprising convolutional
In IDS, data may be acquired in two different ways: and pooling layers, and a fully connected layer with a
firstly, by utilizing existing datasets, and secondly, by softmax classifier in the classification layer. In the realm of
developing one’s dataset. Various databases are widely medical imaging and computer vision, CNN is a huge
employed. KDD-99 is one of the oldest and biggest data- success. They are utilized in the IDS to perform supervised
sets, and although being very unbalanced, it is still utilized feature extraction and classification. Recurrent Neural
owing to a lack of alternatives. NSL-KDD was designed to Networks (RNN) are developed to model sequence data
address the problems with KDD-99. This is one of the and enhance the capabilities of standard feed-forward
baseline databases used for IDS methods, regardless of neural networks. Input, hidden, and output units make up
whether it is old because the threats in this database are an RNN, with the hidden units serving as memory com-
generally outdated. UNSW-NB15, with 49 features and 10 ponents. Every RNN unit uses its current input and the
target classes, essentially eliminates the skewness of KDD- output of the previous input to make a decision. Auto-
99 and NSL-KDD, whereas KDD has 41 features and 5 Encoder (AE) is a widely used DL approach that pertains
targeted classes. CTU13 has 13 scenarios for Botnets; each to the unsupervised neural network class. It is based on the
of these Botnet instances is currently in operation. For each principle of learning the best attributes and matching the
capture, a distinct malware is activated, which conducts output as closely as possible to the input. It has the same
various tasks utilizing distinctive protocols. ISOT is a input and output layers as the input layer, but the hidden
widely used dataset, especially for IoT Botnet attack levels are usually smaller than the input layer. AE is
datasets. Figure 15 shows a comprehensive analysis of symmetric and operates in an Encoder-Decoder mode.,
some of the datasets utilized in the examined articles. In the Sparse AE, Variational AE, and Stacked AE are three
research, there are various tools and approaches for con- kinds of AE. DNN is a fundamental DL framework that
structing a dataset. Wireshark is a network traffic capture allows the model to learn in layers. It has an input layer, an
and presentation tool. Because DoS tools generate pre- output layer, and several hidden layers. Complex nonlinear
dictable traffic, detection rates are high. In addition, anal- systems are also modeled using DNN. An increase in the
ogous to DARPA, Spleen is a software tool for building a number of hidden layers improves the model’s abstraction
dataset. Further components can be added to this program level and hence its capabilities. Deep Belief Network
to improve its effectiveness. CICFlowmeter is a java-based (DBN) is a DL system that is built by layering numerous
network feature extraction application for raw network Restricted Boltzmann Machines (RBM) and then adding a

123
 Cluster Computing

softmax classification layer. An RBM is a two-layer model Additionally, network-based attacks may not be specifi-
that allows data to flow both ways. Each node in a layer is a cally targeting RPL, including (Distributed) DoS attacks.
connected node in the preceding and subsequent levels in Because of the characteristics of RPL-based IoTs, includ-
DBN, nodes within one layer are not interconnected. DBN ing evolving typologies, the passive essence of the wireless
is unsupervised pre-trained using the greedy layer-wise medium, and resource-constraint nodes, RPL-related
learning strategy, then fine-tuned for meaningful features threats are diverse and can be divided into three categories:
using a supervised fine-tuning approach. DBN is utilized network traffic attacks, network topology attacks, and
by IDS for feature extraction and categorization. resource depletion attacks. Resource depletion threats, in
Also, after gathering data on study assessment tech- particular, are hostile operations that aim to exhaust nodes’
niques, 94% of papers use simulation techniques, while 6% processing, storage, or energy resources by giving the
use theoretical or implementation techniques. As shown in appearance of continuing activity. Considering that the
Fig. 16, 29% of papers detect DoS attacks, according to node’s functioning is intrinsically related to the use of
distinguishable attacks. Flooding attacks were second with computing, memory, and energy assets, any overhead is
11.3%, while User Datagram Protocol (UDP) and BOT proportional to their excessive usage. Local consequences
together were third with 9.7%. The majority of the papers may occur, or, even worse, network availability and per-
are about detecting DoS attacks, as far as we can tell. The formance may be impacted, resulting in routing loops,
detection of other forms of attacks is covered in a small needless, congestion and network traffic. Sub-optimization
number of articles. The total information gathered in this and Isolation threats, which disturb node communication
analysis aids investigators in becoming acquainted with and DODAG structure, accordingly, are two types of net-
highly established studies in the IDS field. Because of the work topology strikes. In reality, sub-optimization threats
memory, storage, power, and computing limits of the harm the network’s capacity to achieve optimal conver-
linked devices, routing in RPL-based networks is a difficult gence, for example, they hinder the development of opti-
undertaking. The RPL protocol has several configurable mal routes, affecting network traffic and degrading network
settings to meet a variety of needs, including large-scale services. Topology inconsistencies, considerable packet
deployments, diversity, and portability, as well as change- losses, increased end-to-end delays, network congestion,
adaptive mechanisms. Nevertheless, malicious actions, and node resource depletion are some of the most prevalent
including DoS, physical damages, and/or extraction of results. Because of the mobility of the nodes, the afore-
sensitive information, such as Destination Oriented mentioned effects can be more harmful in dynamic net-
Directed Acyclic Graph (DODAG) version, nodes’ rank works. Also, isolation threats take use of the RPL
values, and IDs, are inevitably attracted to such network network’s tree topology to cut off part(s) of the network by
contexts, which include resource-constrained nodes, sup- stopping nodes’ connection with their parent or sink-node.
porting dynamic topologies, and based on the passive Loss of network traffic, increased end-to-end delays, con-
nature of the wireless medium. In essence, several devices siderable service quality degradation, and isolation of sub-
could be harmed by exploiting RPL; if the node plays a graph sections with starving of their participating nodes are
significant role in the system, including parent nodes or just a few of the consequences. Blackhole attacks are the
sinks, a combination of attacks could be used, with severe most prevalent isolation attacks. Furthermore, network
implications ranging from node resource depletion result- traffic attacks to monitor and intercept network traffic to
ing in a sharp increase in control overhead to severe obtain or deduce information, such as rank value, or DO-
degradation of the protocol’s data delivery efficiency. DAG version, that can later be exploited by attacks.
eavesdropping and misappropriation attacks are classed
based on how the traffic is impacted. In the first scenario,
the attacker watches and examines network communica-
tions, whether via broken node or by directly ‘‘listening’’ to
wirelessly transmitted packets. In this manner, he/she has
accessibility to the structure and routing-related details or
even to the relevant information of the transmitted packets.
Two of the most well-known eavesdropping techniques are
sniffing and network traffic analysis.

Fig. 16 Distinguished attacks that is employed for evaluations

123
Cluster Computing

10 Open issues ensemble of DNNs that served better compared to a

specific ML algorithm is one possible solution to the
One of the most crucial challenging issues in the area of constraints of the particular DL method proposed; how-
IDSs, and there is a variety of work to be done in this ever, such methods were computationally costly and thus
domain. A large number of research articles on IDSs for created network latency problems that can not be managed
IoT have been published. Also, papers show the assessment in sensitive systems that need risks to human lives, such as
of their methods based on synthesized datasets and discuss health and autonomous life.
a particular problem that does not work in real-world Also, It is very demanding to create an online and real-
scenarios. As can be seen from this and other relevant time, anomaly-based IDS for IoT networks. This is because
modern studies carried out on the IDS for IoT, it is very such an IDS will involve studying normal behavior to
difficult to create an IDS that embraces at least the most recognize abnormal behavior first. The learning process
important viewpoints of a powerful IDS, in essence, is implies that no noise or attack traffic can not be guaranteed
scalable, online, operates effectively on real data, deploy- during this time. Such an IDS will produce false alarms if
able and meets the requirements of all stakeholders. these problems are not dealt with. Also, some of the net-
Preferably, much of the published work shares the findings work-based IDS anomalies seek to build a model that
of the evaluation tested on built datasets covering a single records the profile of all possible regular traffic incidents or
or any portion of the process, and uses biased criteria to patterns. However, this is very complicated, since it has
describe the performance. So. we are discussing some of been shown that some models seem to tend toward the
the problems that need to be considered in this part in the dominant class of nature. The regular class results in high
future. Therefore, one of the judgments in this investigation rates of false-positive. Besides, all potential normal con-
is that it is very difficult to create a comprehensive IDS that siderations that may be made on the network, especially in
can provide guarantees of robustness, scalability, accuracy, the heterogeneous context of the IoT network, which
and assurance against all types of threats. Here are some of increases false-negative rates, cannot be reported. Another
the big obstacles facing researchers today and in the future. research challenge in the IDS network is to completely
Since the IoT security standards have not yet matured, minimize or eliminate false-negative rates and false-posi-
there is tremendous scope for future research in this field, tive rates. Also, developing models trained on particular
especially through the use of ML techniques. types of devices will be important. Using a common style
of object, these templates can be extended to IDSs in other
10.1 ML organizations. This would benefit other organizations that
can deploy these models and thus save the resources nee-
As a challenge to future work, researchers can explore the ded to gather the knowledge and train the IDSs. It would
use of ML techniques with specialized cloud-based IDS to benefit to spot malicious IoT objects that are already
gather knowledge. Transfer learning, Reinforcement infected because their actions will vary from the usual
Learning (RL), and semi-supervised learning methods are behavior that qualified models capture. It is a daunting
still not well investigated and analyzed with the purpose of activity and a promising area for future study to build such
the IoT security to reach significant aims, such as accel- models. Also, several studies focused on using IoT data
erated training, and real-time and unified IoT anomaly mining methods to make it more intelligent and provide
detection models, and are potential fields for future study. intelligent devices and services. Therefore, the use of data
Besides, using RL in conjunction with a DNN will be an mining techniques and computational intelligence methods
important research field because their combined use can be is yet another candidate for future work to improve the IDS
useful in IoT network scenarios that involve broad data framework performance.
dimensionality and non-stationary environments. To train a
large dataset model, ML-based and DL approaches are 10.2 The efficiency of the IDS methods
commonly used, and this has allowed cyber-attacks to be
successfully managed. Some issues need to be addressed in IoT objects are resource-restricted because, along with
terms of the use of DL algorithms to detect attacks; for short battery life, they have less storage and processing
example, resource limitations with IoT devices hinder the capability. Computing and storage-intensive procedures
use of ML or DL algorithms to protect IoT networks. that demand more power in terms of such parameters
Another problem with the use of DL techniques in dis- cannot be carried out by such devices. It is also suggested
tributed networks, such as IoT networks, is that, for that small message sizes be used in the IDS method. The
instance, concerning the various scenarios of IoT imple- reasoning behind this is that when sending and receiving
mentation, they face scalability problems. The use of an large messages, it may utilize other object resources that
cause rapid battery drainage of the sensors. The IDSs must

123
 Cluster Computing

therefore be designed in such a way that, without sacri- applications with their abilities and conditions. By and
ficing the technique itself, the suggested method should large, for this form of communication environment, the
have lower communication and storage costs. As another IDS will be a challenging challenge. Authors may have
challengeable future work, to evaluate the behavior of the electronic health records of those users saved for further
IDS in IoT, new tests will be conducted using a larger analysis on an IoT-enabled cloud server. Different objects
number of virtual machines that perform DoS attacks. generate information and send it to the cloud inside the
Attacks using a real machine are also carried out because it Body Area Network (BANs). Consequently, multiple
is evaluated if some variations in detections occur. communicative instruments creates a heterogeneous net-
work. Therefore, researchers require a special form of IDS
10.3 Multi-stage attacks that can preserve all kinds of objects in a communication
environment of this nature. In the future in this direction, a
Over multiple stages, a common intrusion is accomplished, further deep investigation is needed.
each trying to exploit a special vulnerability. These
advanced attacks are known as multi-stage attacks, and 10.7 Cloud server data privacy
common techniques such as IoT are common and emerging
computing systems. Authors assume that IoT systems’ Data privacy outlines how the details of the various
dynamic essence is non-trivial, requiring specific efforts to resources should be maintained. Also, IoT-based system is
address the challenge of multi-stage attack detection. It is utilized for information-sensitive purposes such as smart
an interesting area for further work to address protection healthcare. Smart health objects are placed around the
and detection within the IoT systems against multi-stage patient’s body in such a privacy-demanding environment to
attacks. identify her or his health data and send data for processing
and storage to the cloud servers. As we know, such a form
10.4 IDS Cross-platform of communication environment will be targeted by various
kinds of intrusions. Besides, this creates a disturbance in
The heterogeneity of the IoT ecosystem creates problems data processing and loss of stored data as well. Maintaining
when the authors plan to deploy IDS and it allows for the the privacy of data, i.e. data stored and data in transit, then
interconnection of different fields of operation, but it cre- becomes essential. Researchers also need modern, effective
ates challenges for the efficient design of the IDS method. schemes to protect the privacy of stored data and data in
For example, to access the data, a smart home application transit. Furthermore, the privacy-aware IDS should be
requires a health care sensing device, the IDS must be configured to protect the privacy of the system and user in
compatible and powerful, so that the data from the target the IoT environment.
network can be recovered without any issues. It should be
noted, however, that data is most of the time saved on a 10.8 IoT environment heterogeneity
cloud for which various IDS methods are needed. For such
applications, authors need successful and powerful IDSs to As we have various kinds of things ranging from full-edge
present smooth communication over the different IoTs. desktops, notebooks, and personal digital assistants to low-
powered sensing objects and low-end RFID tags, IoT-based
10.5 IDS security communication circumstances vary in nature. Besides,
these objects operate under the guidelines of various forms
The IoT IDS techniques are typically not secure because of protocols for communication. It is also necessary to bear
they do not have full evidence of protection against dif- in mind that these devices vary in terms of their operating
ferent kinds of attacks. Any of the approaches in the lit- system, range of communication, processing power, and
erature are particular attacks and do not achieve several storage. Researchers need to develop an efficient IDS in
attacks simultaneously. It is therefore important for authors such a way that all various kinds of objects and associated
to create such an IDS approach that should be both secure technologies are covered.
and resilient against multiple attacks at the same time. In addition, exploring the formal verification and
Outlining such a technique may be a challenge owing to the behavioral modeling of the examined strategies are
resource restrictions of IoT objects. promising research directions for the future. Eventually,
combining some meta-heuristic techniques like world cup
10.6 Scalability optimization algorithm, differential evolution, harmony
search, Particle Swarm Optimization (PSO), bee colony,
WSN combined IoT is a variety of different large-scale mixed-integer genetic algorithm, imperialist competitive
networks with numerous communication models and algorithm, and imperialist competitive method with neural

123
Cluster Computing

networks and fuzzy logic for designing efficient IDSs is an contemporary trend is to employ intermediary nodes at the
exciting line of research for the future. network edge to solve these restrictions, with end devices
sending their data to these nodes functioning as federated
10.9 Low power networks (LP-WPANs) learning clients. In a federated learning scenario, some
authors utilize intermediary entities in charge of executing
The presented IDSs primarily assume a network scenario local training. Nevertheless, exchanging network traffic
with a set amount of nodes in a static environment. A low with these intermediary nodes to identify possible threats
power network, on the other hand, is a lossy and unsta- might still cause privacy problems. Other options include
ble dynamic network. Devices may shift in and out of the segmenting and displaying data to reduce the amount of
system constantly. Therefore, the number of nodes fluctu- data that has to be provided, as well as studying feature
ates over time. Moreover, while building IDS for RPL, it is selection. As a result, further research is needed to better
critical to address such a dynamic, unpredictable, and understand the practical constraints of federated learning
scalable network since such factors have a direct impact on methodologies in IoT contexts, as well as the privacy and
the detection of attacks including selective-forwarding security implications of edge computing systems. A
attacks, sinkholes, flooding, and so on. In addition, one of promising study topic in this regard is the use of TinyML
the primary constraints that make IDS adoption in IoT frameworks, such as TensorFlow Lite, in federated learning
contexts difficult is the resource-constrained nature of IoT settings.
systems. Because of the computational cost, traditional
IDSs cannot be applied in an IoT context. These method-
ologies need a large number of resources, including 11 Conclusion and limitation
memory/storage for data categorization, which is not nor-
mally accessible in such situations. As a result, lightweight To the remarkable growth experienced by IoT, the amount
IDSs with fewer resources are required. Also, maintaining and range of security threats for such methods have risen in
all security criteria is a big challenge for low-cost IoT number, demonstrating the value of an effective IDS.
devices. Because of these limits, DL methods’ capabilities While common security solutions are used in software
could not be used. DL approaches combined with sophis- systems like firewalls and access control mechanisms, IDS
ticated hyperparameter adjustment methods might be used is also very important. Also, IDS is a flow that detects
to solve this problem. However, DL does not always malicious actions against the victims using a range of
necessitate feature engineering, doing so makes the design mechanisms. Many techniques have already been presented
lighter. The models may then be employed at the node to detect possible intrusions into software systems. There is
level, providing for speedier action in the event of an also a need for the making of more robust IoT security
attack. So, effectively employing DL methods will help solutions. One of the principal approaches for IoT security
alleviate the effect of resource constraints while also uti- is ML-based IDS which is capable of the IDS method
lizing newly accessible methodologies. acting intelligently. In this paper, a review of IDS inves-
tigation works for IoT was provided by the authors. In the
10.9.1 Industrial IoT literature, the authors picked 24 papers that suggested
particular IoT IDS methods or developed IoT attack
To ensure the safety of linked systems and supplied ser- detection techniques that could be elements of an IDS. The
vices in the new era of Industry 4.0 and IIoT, a unique papers considered for review have been published since
IDS must be designed. Prevention techniques for particular 2018 based on the investigation of the state-of-the-art IDS
threats to the IIoT ecosystem, such as smart grid, trans- methods. The authors used a classification, which is based
portation, smart industrial, and so on, require further on the detection process, to classify these articles. How-
investigation. Creating a lightweight security strategy for ever, the main contribution of the authors in this paper is
smart grid applications based on a low-computation divided into three parts: (1) An in-depth review of modern
method appropriate for restricted devices. IDS methods; (2) a detailed comparison of methods; and
(3), finally, suggestions for a wide range of challenges and
10.9.2 IoT devices with federated learning opportunities for future direction. The retrieved results
revealed that detection accuracy is at its peak of 35.9%. We
In terms of memory, processing power, and energy con- can see that 8.3% of the studies are centralized, while 54%
sumption, the computational needs of well-known ML are distributed. Simulation approaches are used in 94% of
techniques may not be met by restricted IoT devices. This the publications, whereas theoretical or implementation
problem could be exacerbated when using DL approaches, techniques are used in 6% of the studies. Furthermore,
which need far more processing resources than ML. A Contiki/Cooja is used in 43.8% of simulation-based

123
 Cluster Computing

articles. IoT environments are the most often used for 13. Ghobaei-Arani, M., Souri, A., Rahmanian, A.A.: Resource
IDSs. Furthermore, KD-99 is the most commonly utilized management approaches in fog computing: a comprehensive
review. J. Grid Comput. 18(1), 1–42 (2020)
dataset. According to distinct attacks, 29% of papers detect 14. Souri, A., Ghobaei-Arani, M.: Cloud manufacturing service
DoS attacks. Finally, we hope that the research findings composition in IoT applications: a formal verification-based
will be useful in the development of IDS-IoT methods in approach. Multimedia Tools Appl. pp. 1–20 (2021)
real-world scenarios. 15. Jabraeil Jamali, M.A., et al.: IoT security. In: Towards the
Internet of Things: Architectures, Security, and Applications,
The goal of this research was to be comprehensive, pp. 33–83. Springer International Publishing, Cham (2020)
although there were certain limits. Some limitations 16. Stojmenovic, I., et al.: An overview of fog computing and its
include a lack of research on local articles, a lack of security issues. Concurr. Comput. 28(10), 2991–3005 (2016)
research on non-English publications, and a lack of 17. Balasundaram, J., A novel optimized Bat Extreme Learning
intrusion detection system for smart Internet of Things networks.
research on conference papers. Int. J. Commun. Syst. p. e4729.
18. Almiani, M., et al.: Deep recurrent neural network for IoT
intrusion detection system. Simul. Model. Pract. Theory 101,
Funding Not applicable. 102031 (2020)
19. Heidari, A., et al.: Machine learning applications for COVID-19
Data availability The paper contains all of the data. outbreak management. Neural Comput. Appl. (2022)
20. Khraisat, A., Alazab, A.: A critical review of intrusion detection
systems in the internet of things: techniques, deployment strategy,
Declarations validation strategy, attacks, public datasets and challenges.
Cybersecurity 4(1), 1–27 (2021)
Conflict of interest The authors declare that they have no known 21. Heidari, A., et al.: The COVID-19 epidemic analysis and diag-
competing financial interests or personal relationships that could have nosis using deep learning: A systematic literature review and
appeared to influence the work reported in this paper. future directions. Comput. Biol. Med. p. 105141 (2021)
22. Jamali, M.A.J., et al.: IoT architecture. Towards Internet Things
Ethical approval Not Applicable. pp. 9–31 (2020)
23. Heidari, A., et al.: A privacy-aware method for COVID-19
detection in chest CT images using lightweight deep conventional
neural network and blockchain. Comput. Biol. Med. p. 105461
References (2022)
24. Yahyaoui, A., et al.: READ-IoT: reliable event and anomaly
1. Andoni, M., et al.: Blockchain technology in the energy sector: A detection framework for the internet of things. IEEE Access 9,
systematic review of challenges and opportunities. Renew. Sus- 24168–24186 (2021)
tain. Energy Rev. 100, 143–174 (2019) 25. Liu, Z., et al.: Intrusion detection systems in the cloud computing:
2. Heidari, A., et al.: Internet of Things offloading: ongoing issues, a comprehensive and deep literature review. Concurr. Comput., p.
opportunities, and future challenges. Int. J. Commun Syst 33(14), e6646 (2021)
e4474 (2020) 26. Meng, W., Li, W., Zhou, J.: Enhancing the security of block-
3. Rahman, S.A., et al.: Internet of things intrusion detection: cen- chain-based software defined networking through trust-based
tralized, on-device, or federated learning? IEEE Network 34(6), traffic fusion and filtration. Inform. Fusion 70, 60–71 (2021)
310–317 (2020) 27. Jamali, M.A.J., et al.: Some cases of smart use of the IoT. In:
4. Jamali, J. et al.: Towards the internet of things. Springer (2020) Towards the internet of things, pp. 85–129. Springer, New York
5. Jamali, M.A.J., et al.: The IoT landscape. In: Towards the Internet (2020)
of Things, pp. 1–8. Springer, New York (2020) 28. Balasundaram, J.: A novel optimized Bat Extreme Learning
6. Heidari, A. and N.J. Navimipour.: Service Discovery Mecha- intrusion detection system for smart Internet of Things networks.
nisms in the Cloud Computing: A Comprehensive and Systematic Int. J. Commun. Syst. 34(7), e4729 (2021)
Literature Review. Kybernetes, (2021) 29. Kalathiripi, R.: Regression coefficients of traffic flow metrics
7. Venkatraman, S., Surendiran, B.: Adaptive hybrid intrusion (RCTFM) for DDOS defense in IoT networks. Int. J. Commun
detection system for crowd sourced multimedia internet of things Syst 34(6), e4330 (2021)
systems. Multimedia Tools Appl. 79(5), 3993–4010 (2020) 30. Liang, W. et al.: Data Fusion Approach for Collaborative Ano-
8. Jamali, M.A.J. et al.: Towards the internet of things architectures, maly Intrusion Detection in Blockchain-based Systems. IEEE
security, and applications. Internet Things J. (2021)
9. Dutta, M., Granjal, J.: Towards a secure internet of things: a 31. Heidari, A., Navimipour, N.J.: A new SLA-aware method for
comprehensive study of second line defense mechanisms. IEEE discovering the cloud services using an improved nature-inspired
Access 8, 127272–127312 (2020) optimization algorithm. PeerJ Comput. Sci. (2021)
10. Simoglou, G., et al.: Intrusion Detection Systems for RPL 32. Sajith, P., Nagarajan, G.: Optimized intrusion detection system
Security: A Comparative Analysis. Computers & Security, using computational intelligent algorithm. In: Advances in
p. 102219 (2021) Electronics, Communication and Computing, pp. 633–639.
11. Boyanapalli, A., Shanthini, A.: A Comparative study of tech- Springer, New York (2021)
niques, datasets and performances for intrusion detection systems 33. Kumar, R., Tripathi, R.: DBTP2SF: a deep blockchain-based
in IoT. In: Artificial Intelligence Techniques for Advanced trustworthy privacy-preserving secured framework in industrial
Computing Applications. Springer. pp. 225–236 internet of things systems. Trans. Emerging Telecommun.
12. Ramaiah, M., et al.: An intrusion detection system using opti- Technol. p. e4222 (2021)
mized deep neural network architecture. Transactions on
Emerging Telecommunications Technologies: pp. e4221

123
Cluster Computing

34. Iqbal, S., et al.: On cloud security attacks: A taxonomy and 55. Kim, S., Hwang, C., Lee, T.: Anomaly based unknown intrusion
intrusion detection and prevention as a service. J. Netw. Comput. detection in endpoint environments. Electronics 9(6), 1022
Appl. 74, 98–120 (2016) (2020)
35. Vieira, K., et al.: Intrusion detection for grid and cloud com- 56. Gothawal, D.B., Nagaraj, S.: Anomaly-based intrusion detection
puting. It Professional 12(4), 38–43 (2009) system in RPL by applying stochastic and evolutionary game
36. Patel, A., et al.: An intrusion detection and prevention system in models over IoT environment. Wireless Pers. Commun. 110(3),
cloud computing: a systematic review. J. Netw. Comput. Appl. 1323–1344 (2020)
36(1), 25–41 (2013) 57. Alhakami, W., et al.: Network anomaly intrusion detection using
37. Keserwani, P.K., et al.: A smart anomaly-based intrusion detec- a nonparametric Bayesian approach and feature selection. IEEE
tion system for the Internet of Things (IoT) network using GWO– Access 7, 52181–52190 (2019)
PSO–RF model. J. Reliable Intell. Environ., pp. 1–19 (2021) 58. Roy, S., et al.: A lightweight supervised intrusion detection
38. Manhas, J., Kotwal, S.: Implementation of intrusion detection mechanism for IoT networks. Futur. Gener. Comput. Syst. 127,
system for internet of things using machine learning techniques. 276–285 (2022)
In: Multimedia Security, pp. 217–237. Springer, New York 59. Vacca, J.R.: Computer and information security handbook.
(2021) Newnes (2012)
39. Hu, N., et al.: A multiple-kernel clustering based intrusion 60. Li, W., et al.: Designing collaborative blockchained signature-
detection scheme for 5G and IoT networks. Int. J. Mach. Learn. based intrusion detection in IoT environments. Futur. Gener.
Cybernet. pp. 1–16. Comput. Syst. 96, 481–489 (2019)
40. Jamali, M.A.J., et al.: Towards the Internet of Things: Archi- 61. Li, J., et al.: Ai-based two-stage intrusion detection for software
tectures, Security, and Applications. Springer, New York (2019) defined iot networks. IEEE Internet Things J. 6(2), 2093–2102
41. Wu, J.: Security and intelligent management for fog/edge com- (2018)
puting resources. In: Fog/Edge Computing For Security, Privacy, 62. Meng, W., et al.: Towards blockchain-enabled single character
and Applications, pp. 213–234. Springer, New York (2021) frequency-based exclusive signature matching in IoT-assisted
42. Atul, D.J., et al.: A machine learning based IoT for providing an smart cities. J. Parall. Distribut. Comput. 144, 268–277 (2020)
intrusion detection system for security. Microprocess. Microsyst. 63. Kumar, M., Verma, H.K., Sikka, G.: A secure lightweight sig-
82, 103741 (2021) nature based authentication for Cloud-IoT crowdsensing envi-
43. Batiha, T., Krömer, P.: Design and analysis of efficient neural ronments. Trans. Emerging Telecommun. Technol. 30(4), e3292
intrusion detection for wireless sensor networks. Concurr. Com- (2019)
put. p. e6152 (2020) 64. Otoum, Y., Nayak, A.: AS-IDS: anomaly and signature based
44. Qiu, H., et al.: Adversarial attacks against network intrusion IDS for the Internet of Things. J. Netw. Syst. Manage. 29(3),
detection in IoT systems. IEEE Internet Things J. (2020) 1–26 (2021)
45. Yang, Z., et al.: A systematic literature review of methods and 65. Dı́az-Verdejo, J., et al.: On the detection capabilities of signature-
datasets for anomaly-based network intrusion detection. Comput. based intrusion detection systems in the context of web attacks.
Secur. p. 102675 (2022) Appl. Sci. 12(2), 852 (2022)
46. Rani, R., et al.: Towards green computing oriented security: a 66. Mitchell, R., Chen, I.-R.: A survey of intrusion detection tech-
lightweight postquantum signature for IoE. Sensors 21(5), 1883 niques for cyber-physical systems. ACM Comput. Surveys
(2021) (CSUR) 46(4), 55 (2014)
47. Keserwani, P.K., et al.: A smart anomaly-based intrusion detec- 67. Quincozes, S.E., et al.: GRASP-based Feature Selection for
tion system for the Internet of Things (IoT) network using GWO– Intrusion Detection in CPS Perception Layer. In: 2020 4th Con-
PSO–RF model. J. Reliab. Intell. Environ. 7(1), 3–21 (2021) ference on Cloud and Internet of Things (CIoT). IEEE (2020)
48. Du, H., Zhang, Y.: Network anomaly detection based on selective 68. Spathoulas, G., Katsikas, S.: Methods for post-processing of
ensemble algorithm. J. Supercomput. 77(3), 2875–2896 (2021) alerts in intrusion detection: a survey. Int. J. Inform. Secur. Sci.
49. Irshad, M.: A systematic review of information security frame- 2(2), 64–80 (2013)
works in the internet of things (iot). in High Performance Com- 69. Cui, J.-F. et al.: Optimization scheme for intrusion detection
puting and Communications; IEEE 14th International Conference scheme GBDT in edge computing center. Comput. Commun.
on Smart City; IEEE 2nd International Conference on Data Sci- (2020).
ence and Systems (HPCC/SmartCity/DSS), 2016 IEEE 18th 70. Sharma, V., et al.: BRIoT: behavior rule specification-based
International Conference on. IEEE (2016) misbehavior detection for IoT-embedded cyber-physical systems.
50. Bahram Abadi, R.M., Rahmani, A.M., Alizadeh, S.H.: Server IEEE Access 7, 118556–118580 (2019)
consolidation techniques in virtualized data centers of cloud 71. Choudhary, G., et al.: Lightweight misbehavior detection man-
environments: A systematic literature review. Software 48(9), agement of embedded IoT devices in medical cyber physical
1688–1726 (2018) systems. IEEE Trans. Netw. Serv. Manage. 17(4), 2496–2510
51. Al-Samarraie, H., Saeed, N.: A systematic review of cloud (2020)
computing tools for collaborative learning: opportunities and 72. Siu, J.Y., Panda, S.K.: A Specification-Based Detection for
challenges to the blended-learning environment. Comput. Educ. Attacks in the Multi-Area System. In: IECON 2020 the 46th
124(May), 77–91 (2018) Annual Conference of the IEEE Industrial Electronics Society.
52. Zarpelão, B.B., et al.: A survey of intrusion detection in Internet IEEE (2020)
of Things. J. Netw. Comput. Appl. 84, 25–37 (2017) 73. Babu, M.J., Reddy, A.R.: SH-IDS: specification heuristics based
53. Almalawi, A., et al.: Add-on anomaly threshold technique for intrusion detection system for IoT networks. Wireless Pers.
improving unsupervised intrusion detection on SCADA data. Commun. 112(3), 2023–2045 (2020)
Electronics 9(6), 1017 (2020) 74. Violettas, G., et al.: A softwarized intrusion detection system for
54. Eskandari, M., et al.: Passban IDS: An intelligent anomaly based the RPL-based Internet of Things networks. Futur. Gener.
intrusion detection system for IoT edge devices. IEEE Internet Comput. Syst. 125, 698–714 (2021)
Things J. (2020) 75. Santos, L., et al.: A flow-based intrusion detection framework for
internet of things networks. Clust. Comput. pp. 1–21 (2021)

123
 Cluster Computing

76. Davahli, A., Shamsi, M., Abaei, G.: Hybridizing genetic algo- Springer Nature or its licensor (e.g. a society or other partner) holds
rithm and grey wolf optimizer to advance an intelligent and exclusive rights to this article under a publishing agreement with the
lightweight intrusion detection system for IoT wireless networks. author(s) or other rightsholder(s); author self-archiving of the
J. Ambient Intell. Hum. Comput. (2020) accepted manuscript version of this article is solely governed by the
77. RM, S.P., et al.; An effective feature engineering for DNN using terms of such publishing agreement and applicable law.
hybrid PCA-GWO for intrusion detection in IoMT architecture. Arash Heidari received his B.Sc.
Comput. Commun. (2020) in Computer Engineering from
78. Li, W., Meng,W., Au, M.H.: Enhancing collaborative intrusion PNU, Iran, M.Sc. from IAU,
detection via disagreement-based semi-supervised learning in IoT Science and Research Branch,
environments. J. Netw. Comput. Appl. pp. 102631 (2020) Iran, in 2014 and 2017, respec-
79. Bostani, H., Sheikhan, M.: Hybrid of anomaly-based and speci- tively. Also, Ph.D. in Computer
fication-based IDS for Internet of Things using unsupervised OPF Engineering from Islamic Azad
based on MapReduce approach. Comput. Commun. 98, 52–71 University, Iran. He is the author
(2017) and co-author of several publi-
80. Moizuddin, M., Jose, M.V.: A bio-inspired hybrid deep learning cations in technical journals,
model for network intrusion detection. Knowl.-Based Syst. 238, conferences, and technical
107894 (2022) books. Besides, he is a reviewer
81. de Souza, C.A., et al.: Hybrid approach to intrusion detection in of several high-ranked journals.
fog-based IoT environments. Comput. Netw. 180, 107417 (2020) Arash is a guest editor for
82. Muhammad, G., Hossain, M.S., Garg, S.: Stacked Autoencoder- Cluster Computing (Springer),
based Intrusion Detection System to Combat Financial Fraudu- and Grid Computing journal (Springer). Moreover, Dr. Heidari is a
lent. IEEE Internet Things J. (2020) member of the IEEE ICCP conference’s technical committee. Arash is
83. Kumar, P., Gupta, G.P., Tripathi, R.: TP2SF: a trustworthy pri- also a member of IEEE, IEEE Communications Society, and IEEE
vacy-preserving secured framework for sustainable smart cities Young Professionals. In addition, Dr. Heidari is a consultant in vari-
by leveraging blockchain and machine learning. J. Syst. Archit. ous Iranian startups, including Aizheimer International Startup. His
p. 101954, (2020) current research interests are IoT and IoT Security, Resource Man-
84. Kumar, P., Gupta, G.P., Tripathi, R.: A distributed ensemble agement, Cloud Computing, Edge and Fog Computing, Image Pro-
design based intrusion detection system using fog computing to cessing, Deep Learning, and Blockchain.
protect the internet of things networks. J. Ambient Intell. Hum.
Comput. pp. 1–18 (2020) Mohammad Ali Jabraeil Jamali
85. Heartfield, R., et al.: Self-configurable cyber-physical intrusion received his B.Sc. in Electrical
detection for smart homes using reinforcement learning. IEEE Engineering from Urmia
Trans. Inf. Forensics Secur. 16, 1720–1735 (2020) University, Urmia, Iran, the
86. Satam, P. Hariri, S.: WIDS: an anomaly based intrusion detection M.Sc. in Electrical Engineering
system for Wi-Fi (IEEE 802.11) Protocol. IEEE Transactions on from Tabriz University, Tabriz,
Network and Service Management (2020) Iran, the M.Sc. in Computer
87. Gassais, R., et al.: Multi-level host-based intrusion detection Engineering from Islamic Azad
system for Internet of things. J. Cloud Comput. 9(1), 1–16 (2020) University, Science and
88. Singh, P. et al.: DaaS: dew computing as a service for intelligent Research Branch, Tehran, Iran,
intrusion detection in edge-of-things ecosystem. IEEE Internet and the Ph.D. in Computer
Things J. (2020) Engineering from Islamic Azad
89. Xu, X., et al.: Towards effective intrusion detection using log- University, Science and
cosh conditional variational autoencoder. IEEE Internet Things J. Research Branch, Tehran, Iran,
(2020) in 1994, 1997, 2003 and 2009,
90. Sadikin, F., van Deursen, T., Kumar, S.: A ZigBee intrusion respectively. He is an assistant professor of Computer Engineering at
detection system for IoT using secure and efficient data collec- Islamic Azad University, Shabestar branch. He is the author/co-author
tion. Internet Things 12, 100306 (2020) of more than 50 publications in technical journals and conferences.
91. D’Angelo, G., Castiglione, A., Palmieri, F.: A cluster-based His current research interests are processor and computer architec-
multidimensional approach for detecting attacks on connected tures, chip multiprocessors, multiprocessor systems-on-chip, networks
vehicles. IEEE Internet Things J. (2020) on chip, ad hoc and sensor networks, security, and the internet of
things.
Publisher’s Note Springer Nature remains neutral with regard to
jurisdictional claims in published maps and institutional affiliations.

123