Skip to main content

Advances, Systems and Applications

Journal of Cloud Computing Cover Image

Table 4 A descriptive statistical analysis of the surveyed IDSs in terms of the important performance metrics affecting IDS suitability in IoT systems

From: Intrusion detection systems for IoT-based smart environments: a survey

Reference TPR (%) FPR (%) Energy (J) Processing time (s) Performance overhead
Liu et al. (2011) [87] - - - - -
Kasinathan et al. (2013) [88, 90] MAX range Zero - * -
  TP = (20-25)     
Jun and Chi (2014) [91] * * - MAX MAX memory = 730 MB
     0.422 MAX CPU = 62%
Krimmling and Peter (2014) [92] * * - - -
Butun et al. (2015) [93] MAX range at MAX TPR - - -
  (90-100) Zero    
Surendar and Umamakeswari (2016) [82] * * MAX range - *
    for one node   
    (0.09-0.1)   
Le et al. (2016) [83] MAX at MAX TPR for one node 120 -
  100 6.78 0.12   
Bostani and Sheikhan (2017) [84] MAX at MAX TPR   - -
  100 2.98    
Garcia-Font et al. (2017) [95] MAX range at MAX TPR - - -
  (50-60) (25-30)    
Fu et al. (2017) [96] * * - * -
Deng et al. (2018) [97] 96.8 1.6 - * -
Amouri et al. (2018) [99] 100 * - 3000 -
Liu et al. (2018) [100] MAX 1.5 - MAX range -
  97.4    (0.5-0.6)  
Abhishek et al. (2018) [101] MAX at MAX TPR - - -
  100 5.5    
Oh et al. (2014) [102] 100 Zero - MAX at best -
     performance = 40  
Summerville et al. (2015) [103] MAX * - - -
  100     
Mohan et al. (2016) [37] * * - - -
Arrignton et al. (2016) [104] * * - - -
Gupta et al. (2013) [105] - - - - -
Raza et al. (2013) [106] MAX range at MAX TPR for one node 120 Memory
  (80-100) Zero 2.88   1.76 KB
Khan and Herrmann (2017) [107] MAX at MAX TPR * - *
  100 1.1    
  1. The symbol (-) indicates that no experimental result is available for the corresponding metric. The symbol * indicates that no numerical result was determined for this metric. The terms MAX and MAX range refer to the maximum result or maximum range result, respectively, for this metric. The terms CPU, memory, TP, TPR, and FPR denote the utilization of the central processing unit (as a percentage), the memory consumption (in bytes), the number of anomalies correctly classified, the probability of detecting intrusions (as a percentage) and the probability of incorrectly identifying normal data as an intrusion (as a percentage), respectively. The energy and processing time values are measured in units of joules and seconds, respectively