{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T14:49:10Z","timestamp":1785336550644,"version":"3.55.0"},"reference-count":59,"publisher":"MDPI AG","issue":"6","license":[{"start":{"date-parts":[[2021,6,4]],"date-time":"2021-06-04T00:00:00Z","timestamp":1622764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>An intrusion detection system (IDS) is an active research topic and is regarded as one of the important applications of machine learning. An IDS is a classifier that predicts the class of input records associated with certain types of attacks. In this article, we present a review of IDSs from the perspective of machine learning. We present the three main challenges of an IDS, in general, and of an IDS for the Internet of Things (IoT), in particular, namely concept drift, high dimensionality, and computational complexity. Studies on solving each challenge and the direction of ongoing research are addressed. In addition, in this paper, we dedicate a separate section for presenting datasets of an IDS. In particular, three main datasets, namely KDD99, NSL, and Kyoto, are presented. This article concludes that three elements of concept drift, high-dimensional awareness, and computational awareness that are symmetric in their effect and need to be addressed in the neural network (NN)-based model for an IDS in the IoT.<\/jats:p>","DOI":"10.3390\/sym13061011","type":"journal-article","created":{"date-parts":[[2021,6,7]],"date-time":"2021-06-07T01:56:40Z","timestamp":1623031000000},"page":"1011","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":53,"title":["An Intrusion Detection System for the Internet of Things Based on Machine Learning: Review and Challenges"],"prefix":"10.3390","volume":"13","author":[{"given":"Ahmed","family":"Adnan","sequence":"first","affiliation":[{"name":"Department of Communication Technology and Networks, Faculty of Computer Science and Information Technology, University Putra Malaysia, Serdang 43300, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0088-7073","authenticated-orcid":false,"given":"Abdullah","family":"Muhammed","sequence":"additional","affiliation":[{"name":"Department of Communication Technology and Networks, Faculty of Computer Science and Information Technology, University Putra Malaysia, Serdang 43300, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Abdul Azim","family":"Abd Ghani","sequence":"additional","affiliation":[{"name":"Department of Software Engineering and Information System, Faculty of Computer Science and Information Technology, University Putra Malaysia, Serdang 43300, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Azizol","family":"Abdullah","sequence":"additional","affiliation":[{"name":"Department of Communication Technology and Networks, Faculty of Computer Science and Information Technology, University Putra Malaysia, Serdang 43300, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fahrul","family":"Hakim","sequence":"additional","affiliation":[{"name":"Department of Communication Technology and Networks, Faculty of Computer Science and Information Technology, University Putra Malaysia, Serdang 43300, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2021,6,4]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Ogudo, K.A., Nestor, D.M.J., Khalaf, O.I., and Kasmaei, H.D. (2019). A device performance and data analytics concept for smartphones\u2019 IoT services and machine-type communication in cellular networks. Symmetry, 11.","DOI":"10.3390\/sym11040593"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"4151","DOI":"10.1007\/s12652-017-0659-1","article-title":"The impact of the hybrid platform of internet of things and cloud computing on healthcare systems: Opportunities, challenges, and open problems","volume":"10","author":"Darwish","year":"2019","journal-title":"J. Ambient Intell. Humaniz. Comput."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"247","DOI":"10.1016\/j.future.2019.04.020","article-title":"The role of big data analytics in industrial Internet of Things","volume":"99","author":"Rehman","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"6822","DOI":"10.1109\/JIOT.2019.2912022","article-title":"Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things","volume":"6","author":"Zolanvari","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"351","DOI":"10.1016\/j.future.2018.11.039","article-title":"A novel code data dissemination scheme for Internet of Things through mobile vehicle of smart cities","volume":"94","author":"Teng","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_6","first-page":"279","article-title":"Iot based intelligent transportation system (IoT-its) for global perspective: A case study","volume":"154","author":"Muthuramalingam","year":"2019","journal-title":"Intell. Syst. Ref. Libr."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Kraemer, F.A., Ammar, D., Braten, A.E., Tamkittikhun, N., and Palma, D. (2017, January 22\u201325). Solar energy prediction for constrained IoT nodes based on public weather forecasts. Proceedings of the Seventh International Conference on the Internet of Things, Linz, Austria.","DOI":"10.1145\/3131542.3131544"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Helbing, D. (2015). Societal, Economic, Ethical and Legal Challenges of the Digital Revolution: From Big Data to Deep Learning, Artificial Intelligence, and Manipulative Technologies. Towards Digital Enlightenment, Springer.","DOI":"10.2139\/ssrn.2594352"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"167","DOI":"10.3844\/jcssp.2020.167.182","article-title":"Artificial intelligence techniques and external factors used in crime forecasting in violence and property: A review","volume":"16","author":"Nabi","year":"2020","journal-title":"J. Comput. Sci."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"848","DOI":"10.3844\/jcssp.2020.848.855","article-title":"AI-based techniques for DDoS attack detection in WSN: A systematic literature review","volume":"16","author":"Rahman","year":"2020","journal-title":"J. Comput. Sci."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"161","DOI":"10.1016\/j.dcan.2017.10.002","article-title":"Machine Learning for Internet of Things Data Analysis","volume":"4","author":"Mahdavinejad","year":"2017","journal-title":"Digit. Commun. Netw."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/MSP.2018.2825478","article-title":"IoT Security Techniques Based on Machine Learning","volume":"35","author":"Xiao","year":"2018","journal-title":"IEEE Signal Process. Mag."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"761","DOI":"10.1016\/j.future.2017.08.043","article-title":"Distributed Attack Detection Scheme using Deep Learning Approach for Internet of Things","volume":"82","author":"Diro","year":"2017","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"102355","DOI":"10.1016\/j.ipm.2020.102355","article-title":"Blockchain-based privacy-preserving remote data integrity checking scheme for IoT information systems","volume":"57","author":"Zhao","year":"2020","journal-title":"Inf. Process. Manag."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1016\/j.comnet.2019.01.035","article-title":"Multi-resolution representation with recurrent neural networks application for streaming time series in IoT","volume":"152","author":"Hu","year":"2019","journal-title":"Comput. Netw."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Leech, C., Raykov, Y.P., Ozer, E., and Merrett, G.V. (2017). Real-time room occupancy estimation with Bayesian machine learning using a single PIR sensor and microcontroller. 2017 IEEE Sensors Applications Symposium (SAS), IEEE.","DOI":"10.1109\/SAS.2017.7894091"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1532","DOI":"10.1109\/ACCESS.2018.2886026","article-title":"An Overview on Concept Drift Learning","volume":"7","author":"Iwashita","year":"2019","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"993","DOI":"10.1016\/j.ejor.2017.08.040","article-title":"High dimensional data classification and feature selection using support vector machines","volume":"265","author":"Ghaddar","year":"2018","journal-title":"Eur. J. Oper. Res."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1016\/j.patrec.2016.11.018","article-title":"Real-time multi-agent system for an adaptive intrusion detection system","volume":"85","author":"Ali","year":"2017","journal-title":"Pattern Recognit. Lett."},{"key":"ref_20","unstructured":"Anderson, J.P. (1980). Computer security threat monitoring and surveillance. Technical Report, James P Anderson Company."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Javed, A.R., Beg, M.O., Asim, M., Baker, T., and Al-Bayatti, A.H. (2020). AlphaLogger: Detecting motion-based side-channel attack using smartphone keystrokes. J. Ambient Intell. Humaniz. Comput.","DOI":"10.1007\/s12652-020-01770-0"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Newsome, J., Shi, E., Song, D., and Perrig, A. (2004, January 27). The Sybil attack in sensor networks: Analysis & defenses. Proceedings of the Third International Symposium on Information Processing in Sensor Networks IPSN, Berkeley, CA, USA.","DOI":"10.1145\/984622.984660"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/j.jnca.2012.09.004","article-title":"Journal of Network and Computer Applications Intrusion detection system: A comprehensive review","volume":"36","author":"Liao","year":"2013","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1007\/s11235-018-0475-8","article-title":"A comprehensive survey on network anomaly detection","volume":"70","author":"Fernandes","year":"2018","journal-title":"Telecommun. Syst."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"390","DOI":"10.1016\/j.eswa.2017.09.013","article-title":"Network anomaly detection system using genetic algorithm and fuzzy logic","volume":"92","author":"Hamamoto","year":"2018","journal-title":"Expert Syst. Appl."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"303","DOI":"10.1016\/j.future.2017.01.029","article-title":"A novel statistical technique for intrusion detection systems","volume":"79","author":"Kabir","year":"2017","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"139","DOI":"10.2298\/CSIS160905039P","article-title":"Evaluation of takagi-sugeno-kang fuzzy method in entropy-based detection of DDoS attacks","volume":"15","author":"Petkovic","year":"2018","journal-title":"Comput. Sci. Inf. Syst."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Dupont, G., den Hartog, J., Etalle, S., and Lekidis, A. (2019). Network intrusion detection systems for in-vehicle network\u2014Technical report. arXiv.","DOI":"10.1109\/ICCVE45908.2019.8965028"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"317","DOI":"10.1007\/BF00116895","article-title":"Incremental learning from noisy data","volume":"1","author":"Schlimmer","year":"1986","journal-title":"Mach. Learn."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Priya, S., and Uthra, R.A. (2020). Comprehensive analysis for class imbalance data with concept drift using ensemble based classification. J. Ambient Intell. Humaniz. Comput.","DOI":"10.1007\/s12652-020-01934-y"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"964","DOI":"10.1007\/s10618-015-0448-4","article-title":"Characterizing Concept Drift","volume":"30","author":"Webb","year":"2016","journal-title":"Data Min. Knowl. Discov."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1007\/s10115-017-1070-0","article-title":"Modeling recurring concepts in data streams: A graph-based framework","volume":"55","author":"Ahmadi","year":"2017","journal-title":"Knowl. Inf. Syst."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1145\/2980765.2980768","article-title":"The Internet of Things: Opportunities and Challenges for Distributed Data Analysis","volume":"18","author":"Stolpe","year":"2016","journal-title":"ACM SIGKDD Explor. Newsl."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"228","DOI":"10.1016\/j.eswa.2016.09.020","article-title":"An evolutionary algorithm for clustering data streams with a variable number of clusters","volume":"67","author":"Raul","year":"2017","journal-title":"Expert Syst. Appl."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1016\/j.eswa.2018.03.021","article-title":"Adapting dynamic classifier selection for concept drift","volume":"104","author":"Almeida","year":"2018","journal-title":"Expert Syst. Appl."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"404","DOI":"10.1016\/j.ins.2019.08.050","article-title":"Exploiting evolving micro-clusters for data stream classification with emerging class detection","volume":"507","author":"Din","year":"2020","journal-title":"Inf. Sci."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Park, S., and Kim, J. (2018, January 1\u20132). Network Intrusion Detection through Online Transformation of Eigenvector Reflecting Concept Drift. Proceedings of the International Conference on Data Science, E-Learning and Information Systems, Madrid, Spain.","DOI":"10.1145\/3279996.3280013"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"205","DOI":"10.1016\/j.knosys.2018.08.007","article-title":"Real-time feature selection technique with concept drift detection using adaptive micro-clusters for data stream mining","volume":"161","author":"Hammoodi","year":"2018","journal-title":"Knowl. Based Syst."},{"key":"ref_39","unstructured":"Wahab, O.A. (2021, February 26). Sustaining the Effectiveness of IoT-Driven Intrusion Detection over Time: Defeating Concept and Data Drifts. Available online: https:\/\/www.techrxiv.org\/articles\/preprint\/Sustaining_the_Effectiveness_of_IoT-Driven_Intrusion_Detection_over_Time_Defeating_Concept_and_Data_Drifts\/13669199\/1."},{"key":"ref_40","unstructured":"Braverman, V. (2017, January 6\u201311). Clustering High Dimensional Dynamic Data Streams. Proceedings of the 34th International Conference on Machine Learning, Sydney, Australia."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"4185","DOI":"10.1007\/s00500-017-2708-2","article-title":"Improved clustering algorithm based on high-speed network data stream","volume":"22","author":"Yin","year":"2017","journal-title":"Soft Comput."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"370","DOI":"10.1016\/j.jnca.2014.11.007","article-title":"MuDi-Stream: A multi density clustering algorithm for evolving data stream","volume":"59","author":"Amini","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"82512","DOI":"10.1109\/ACCESS.2019.2923640","article-title":"An Adaptive Ensemble Machine Learning Model for Intrusion Detection","volume":"7","author":"Gao","year":"2019","journal-title":"IEEE Access"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Jaber, A.N., Zolkipli, M.F., Shakir, H.A., and Mohammed, R. (2018). Host Based Intrusion Detection and Prevention Model Against DDoS Attack in Cloud Computing. International Conference on P2P, Parallel, Grid, Cloud and Internet Computing, Springer.","DOI":"10.1007\/978-3-319-69835-9_23"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Gao, J., Li, J., Zhang, Z., and Tan, P.N. (2005). An incremental data stream clustering algorithm based on dense units detection. Pacific-Asia Conference on Knowledge Discovery and Data Mining, Springer.","DOI":"10.1007\/11430919_49"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Chen, Y., and Tu, L. (2007, January 13\u201317). Density-based clustering for real-time stream data. Proceedings of the 13th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Jose, CA, USA.","DOI":"10.1145\/1281192.1281210"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Aggarwal, C.C., Ctr, T.J.W.R., Han, J., Wang, J., Yu, P.S., and Ctr, T.J.W.R. (2003, January 9\u201312). A Framework for Clustering Evolving Data Streams. Proceedings of the 2003 VLDB Conference, Berlin, Germany.","DOI":"10.1016\/B978-012722442-8\/50016-1"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"573","DOI":"10.1016\/j.ins.2018.09.035","article-title":"Synchronization-based clustering on evolving data stream","volume":"501","author":"Shao","year":"2019","journal-title":"Inf. Sci."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"2215","DOI":"10.1109\/TCYB.2018.2822552","article-title":"Ant Colony Stream Clustering: A Fast Density Clustering Algorithm for Dynamic Data Streams","volume":"49","author":"Fahy","year":"2019","journal-title":"IEEE Trans. Cybern."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"113","DOI":"10.1016\/j.ins.2019.03.022","article-title":"A buffer-based online clustering for evolving data stream","volume":"489","author":"Islam","year":"2019","journal-title":"Inf. Sci."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"249","DOI":"10.1007\/s10115-010-0342-8","article-title":"The ClusTree: Indexing micro-clusters for anytime stream mining","volume":"29","author":"Kranen","year":"2011","journal-title":"Knowl. Inf. Syst."},{"key":"ref_52","unstructured":"Hesabi, Z.R., Sellis, T., and Liao, K. (2018). DistClusTree: A Framework for Distributed Stream Clustering, Springer."},{"key":"ref_53","first-page":"1","article-title":"Multi-layer intrusion detection system with ExtraTrees feature selection, extreme learning machine ensemble, and softmax aggregation","volume":"2019","author":"Sharma","year":"2019","journal-title":"EURASIP J. Inf. Secur."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"308","DOI":"10.1016\/j.future.2019.03.043","article-title":"A deep learning approach for proactive multi-cloud cooperative intrusion detection system","volume":"98","author":"Abusitta","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Khater, B.S., Wahab, A.W.B.A., Idris, M.Y.I.B., Hussain, M.A., and Ibrahim, A.A. (2019). A lightweight perceptron-based intrusion detection system for fog computing. Appl. Sci., 9.","DOI":"10.3390\/app9010178"},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"42450","DOI":"10.1109\/ACCESS.2019.2907965","article-title":"Toward a Lightweight Intrusion Detection System for the Internet of Things","volume":"7","author":"Jan","year":"2019","journal-title":"IEEE Access"},{"key":"ref_57","doi-asserted-by":"crossref","first-page":"379","DOI":"10.1109\/JIOT.2019.2948149","article-title":"A Lightweight Intrusion Detection for Sybil Attack under Mobile RPL in the Internet of Things","volume":"7","author":"Murali","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_58","doi-asserted-by":"crossref","unstructured":"Rummel, M., and Rummel, M. (2011). \u201cDer Social Entrepreneurship-Diskurs. Eine Einf\u00fchrung in die Thematik,\u201d Wer Sind Soc. Entrep. Deutschland?, Springer.","DOI":"10.1007\/978-3-531-94152-3"},{"key":"ref_59","doi-asserted-by":"crossref","unstructured":"Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., and Nakao, K. (2011, January 10). Statistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation. Proceedings of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, Salzburg, Austria.","DOI":"10.1145\/1978672.1978676"}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/13\/6\/1011\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T06:11:02Z","timestamp":1760163062000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/13\/6\/1011"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6,4]]},"references-count":59,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2021,6]]}},"alternative-id":["sym13061011"],"URL":"https:\/\/doi.org\/10.3390\/sym13061011","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6,4]]}}}