Lightweight And Privacy-Preserving Intrusion Detection For The Internet Of Things: A Systematic Review Of Datasets, Models, And Emerging Directions

Abstract

The rapid expansion of Internet of Things (IoT) deployments has been matched by a corresponding rise in device- and network-targeted attacks, while the limited computation, memory, and energy budgets of most IoT endpoints make conventional, resource-intensive intrusion detection systems (IDS) difficult to deploy directly on-device. Over the past five years, a substantial and fast-growing literature has proposed lightweight machine learning (ML) and deep learning (DL) approaches to this problem, spanning classical feature-reduction pipelines, pruned and quantized deep architectures, spiking neural networks, TinyML-optimized models, and federated and privacy-preserving training schemes. This paper presents a systematic review of this literature, organized around four themes: (1) the benchmark datasets that underpin current evaluation practice, (2) model-level techniques for achieving detection accuracy under strict resource budgets, (3) federated and privacy-preserving training architectures suited to distributed IoT deployments, and (4) the emerging role of explainability in IoT IDS. We synthesize reported results across more than twenty recent studies, present a comparative summary of representative approaches, and identify recurring gaps in the literature, including limited cross-dataset generalization evidence, inconsistent resource-cost reporting, and uneven treatment of class imbalance for rare but high-impact attack types. We conclude with a set of open research directions intended to guide future work toward more reproducible and deployment-realistic evaluation of lightweight IoT intrusion detection.