Hybrid Internal Anomaly Detection System for IoT: Reactive Nodes with Cross-Layer Operation

Table 1

Comparison between related approaches and our work.

	Decision making	Network monitor	Message exchange among nodes	Message exchange between nodes & router or cluster head	Protocol	Compulsory node participation	Evaluation
[25]	distributed; (through vote)	distributed	yes	-	-	yes	simulation
[26]	distributed; (through vote)	distributed (every; node)	yes	yes	MultihopLQI	yes	simulation
[27]	centralized	distributed; (router through; heart beat msg.)	no	yes	ICMPv6	no	simulation
[28]	centralized	distributed; (watchdog; nodes)	no	yes	BLIPv2	yes	testbed
[29]	centralized; (router)	distributed (every; node)	yes	yes	ICMPv6	yes	simulation
[30]	distributed (cluster; heads)	distributed (cluster; heads)	no	yes	-	yes	simulation
[31]	centralized; (router)	distributed	no	yes	UDP	yes	simulation
this work	hybrid (node and; router or cluster; head)	distributed (every; node)	no	yes	ICMPv6	yes	testbed & simulation