The emergence of smart technologies and the wide adoption of the Internet of Things (IoT) have revolutionized various sectors, yet they have also introduced significant security challenges due to the extensive attack surface they present. In recent years, many efforts have been made to minimize the attack surface. However, most IoT devices are resource-constrained with limited processing power, memory storage, and energy sources. Such devices lack the sufficient means for running existing resource-hungry security solutions, which in turn makes it challenging to secure IoT networks from sophisticated attacks. Feature Selection (FS) approaches in Machine Learning enabled Intrusion Detection Systems (IDS) have gained considerable attention in recent years for having the potential to detect sophisticated cyber-attacks while adhering to the resource limitations issues in IoT networks. Apropos of that, several researchers proposed FS-enabled IDS for IoT networks with a focus on lightweight security solutions. This work presents a comprehensive study discussing FS-enabled lightweight IDS tailored for resource-constrained IoT devices, with a special focus on the emerging Ensemble Feature Selection (EFS) techniques, portraying a new direction for the research community to inspect. The research aims to pave the way for the effective design of futuristic FS/EFS-enabled lightweight IDS for IoT networks, addressing the critical need for robust security measures in the face of resource limitations.

The rapid proliferation of Internet of Things (IoT) devices and advanced obfuscation techniques has led to increasingly sophisticated Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. Traditional intrusion detection systems (IDS) without adaptive capabilities often fail to detect such attacks, resulting in a rising success rate of DoS/DDoS incidents each year. To address these limitations, this study proposes a self-healing intrusion detection system (SH-IDS), a machine learning (ML)-based IDS that enhances IoT network security through collaborative and autonomous adaptation. Unlike existing solutions, the threshold values in SH-IDS are adaptive and computed based on IoT device configurations. When an IoT device detects resource usage exceeding these thresholds, it sends a danger signal that triggers a self-healing process to update the detection model, thereby blocking malicious traffic. Six ML algorithms are evaluated to assess SH-IDS performance. Results show that Random Forest (RF) achieves 59.6% accuracy before self-healing and 99.9% after self-healing, with the highest true positive and true negative rates in detecting emerging DoS/DDoS attacks. Overall, the findings demonstrate that SH-IDS is an effective, adaptive, and flexible solution for mitigating both existing and emerging DoS/DDoS threats.