Table 13.
Cross-paradigm critical comparison of AI-driven IoT intrusion detection approaches with respect to benchmark datasets, evaluation metrics, attack scenarios, computational cost, hardware feasibility, adversarial robustness, industrial deployment maturity, and key limitations.
| Paradigm | Common Benchmark datasets | Common evaluation metrics | Primary attack scenarios | Computational cost | Feasibility on real hardware | Adversarial robustness | Industrial deployment maturity | Key limitations |
|---|---|---|---|---|---|---|---|---|
| Lightweight machine learning | ToN-IoT, CICIDS2017, BoT-IoT | Accuracy, Precision, Recall, F1-score | DDoS, Botnet, Malware | Low | High (Raspberry Pi, Edge Gateway, ARM Cortex) | Moderate | High | Manual feature engineering; limited adaptability to unknown attacks |
| Deep learning | CICIDS2017, CICIoT2023, UNSW-NB15 | Accuracy, F1-score, MCC, ROC-AUC | Multi-class attacks, Zero-day, Malware | High | Moderate (Jetson Nano, GPU-enabled Edge) | Moderate | Moderate | High computational and memory requirements |
| Federated learning | ToN-IoT, CICIDS2017, CICIoT2023 | Accuracy, Precision, Recall, F1-score | Distributed attacks, Privacy-preserving IDS | Moderate | Moderate (Edge–Cloud Collaborative Platforms) | High (with secure aggregation) | High | Communication overhead; non-IID data challenges |
| TinyML | ToN-IoT, BoT-IoT | Accuracy, F1-score, Latency, Energy Consumption | Lightweight malware, Device-level intrusion | Very Low | Very High (ESP32, STM32, Arduino Nano, Cortex-M) | Low–Moderate | Moderate | Limited memory, reduced model complexity |
| Edge–Fog–Cloud | ToN-IoT, CICIDS2017, MQTTEEB-D | Accuracy, Latency, Throughput, QoS | Distributed network attacks, multi-stage attacks | Moderate | High (Edge Servers, Fog Nodes) | Moderate | High | Complex resource orchestration |
| Blockchain-based IDS | ToN-IoT, IIoT datasets | Accuracy, F1-score, Transaction Latency | Model poisoning, Trust attacks, Tampering | High | Moderate | High | Moderate | Consensus latency, storage overhead |
| Trust-aware IDS | ToN-IoT, WSN datasets | Accuracy, Trust Score, F1-score | Insider attacks, Compromised devices | Moderate | High | High | Emerging | Dynamic trust management complexity |
| XAI-based IDS | CICIDS2017, ToN-IoT | Accuracy, SHAP, LIME, Explainability Score | AI-assisted intrusion detection | Moderate–High | Moderate | Moderate | Emerging | Increased computational overhead for explanations |