Skip to main content

Advances, Systems and Applications

Table 4 A descriptive statistical analysis of the surveyed IDSs in terms of the important performance metrics affecting IDS suitability in IoT systems

From: Intrusion detection systems for IoT-based smart environments: a survey

Reference

TPR (%)

FPR (%)

Energy (J)

Processing time (s)

Performance overhead

Liu et al. (2011) [87]

-

-

-

-

-

Kasinathan et al. (2013) [88, 90]

MAX range

Zero

-

*

-

 

TP = (20-25)

    

Jun and Chi (2014) [91]

*

*

-

MAX

MAX memory = 730 MB

    

0.422

MAX CPU = 62%

Krimmling and Peter (2014) [92]

*

*

-

-

-

Butun et al. (2015) [93]

MAX range

at MAX TPR

-

-

-

 

(90-100)

Zero

   

Surendar and Umamakeswari (2016) [82]

*

*

MAX range

-

*

   

for one node

  
   

(0.09-0.1)

  

Le et al. (2016) [83]

MAX

at MAX TPR

for one node

120

-

 

100

6.78

0.12

  

Bostani and Sheikhan (2017) [84]

MAX

at MAX TPR

 

-

-

 

100

2.98

   

Garcia-Font et al. (2017) [95]

MAX range

at MAX TPR

-

-

-

 

(50-60)

(25-30)

   

Fu et al. (2017) [96]

*

*

-

*

-

Deng et al. (2018) [97]

96.8

1.6

-

*

-

Amouri et al. (2018) [99]

100

*

-

3000

-

Liu et al. (2018) [100]

MAX

1.5

-

MAX range

-

 

97.4

  

(0.5-0.6)

 

Abhishek et al. (2018) [101]

MAX

at MAX TPR

-

-

-

 

100

5.5

   

Oh et al. (2014) [102]

100

Zero

-

MAX at best

-

    

performance = 40

 

Summerville et al. (2015) [103]

MAX

*

-

-

-

 

100

    

Mohan et al. (2016) [37]

*

*

-

-

-

Arrignton et al. (2016) [104]

*

*

-

-

-

Gupta et al. (2013) [105]

-

-

-

-

-

Raza et al. (2013) [106]

MAX range

at MAX TPR

for one node

120

Memory

 

(80-100)

Zero

2.88

 

1.76 KB

Khan and Herrmann (2017) [107]

MAX

at MAX TPR

*

-

*

 

100

1.1

   
  1. The symbol (-) indicates that no experimental result is available for the corresponding metric. The symbol * indicates that no numerical result was determined for this metric. The terms MAX and MAX range refer to the maximum result or maximum range result, respectively, for this metric. The terms CPU, memory, TP, TPR, and FPR denote the utilization of the central processing unit (as a percentage), the memory consumption (in bytes), the number of anomalies correctly classified, the probability of detecting intrusions (as a percentage) and the probability of incorrectly identifying normal data as an intrusion (as a percentage), respectively. The energy and processing time values are measured in units of joules and seconds, respectively