The past three decades have seen a massive paradigm shift in computing technology. This shift is mainly due to increased computing power and communication speed. The latter has enabled us to develop intelligent devices that can communicate with each other. These intelligent devices make up the Internet of Things (IoT) ecosystem. The IoT ecosystem is deployed in cities, healthcare, energy, agriculture, transportation, and industries. Moreover, the internet of things has become a household name because of its numerous benefits to the various domains it has been applied to. However, these benefits have made the IoT ecosystem attractive to cyber attackers. Over the years, security methodologies like encryption, authentication, data confidentiality, access control, and privacy have been proposed by several researchers to ensure security in IoT environments. Despite these security solutions, IoT systems are still vulnerable and highly susceptible to cyber-attacks. An alternative approach to fighting these attacks is to detect them using Intrusion Detection Systems (IDS). In traditional computer networks, IDS monitors the network’s activities. Although the concept of intrusion detection has been well explored in traditional computing and network systems as far back as the 1980s, the idea is in its infant stage in IoT security ¹ . The computational constraints of IoT systems make it practically impossible to implement traditional IDS in IoT environments. Although many IDS solutions have been proposed, most use offline or batch machine learning models. This situation makes these models computationally expensive and difficult to deploy on IoT devices. An alternative to the above-mentioned the approach is to build IDS that learn from data streams, which can produce IDS with minimal computational usage. In this paper, the authors seek to present a systematic review of incremental ML-based IDS in IoT systems. Several surveys and review articles have been done in IDS for IoT. But to the best of our knowledge, none of these surveys or SLRs focuses on the role of incremental machine learning and how they can lead to lightweight IDS that are suitable for the IoT ecosystem. This study covers work done using incremental ML to develop IDS for IoT systems from 2010 to 2022. The period from 2010 to 2022 was adopted for this study because we wanted to analyze the research trend of incremental ML-based IDS in IoT systems since 2010. We used the methods identified by 2, 3 to conduct our studies. This work differs from other existing studies by exploring how incremental machine learning methods achieve lightweight IDS that fit into the computational constraint nature of IoT systems. The study further considers some of the general potential problems facing the implementation of IDS in IoT environments. A total of 168 studies were returned based on our search criteria, but eight (8) studies were found to be IoT-based after applying our formulated inclusion and exclusion criteria. However, because the number was small, we decided to include studies that satisfied the inclusion criteria but were not IoT-based, which yielded 13 studies. This brought the total number of studies considered in this SLR to 21. However, most of our analyses were primarily focused on IoT-based studies since this study’s objective. The primary contributions of our study are as follows:

The following is how the paper is structured. Sections 2 and 3 discuss related works and the research methodology employed. Sections 4 and 5 discuss the findings, challenges, and future research directions. Section 6 discusses validity threats, while Section 7 discusses the study’s conclusion.

This section presents some survey and review papers that are closely related to our study. We considered existing survey and review studies focusing on intrusion detection in IoT systems for the past five years, 2017–2022. We considered the past five years because most surveys and SLRs for IoT-based intrusion detection systems that are of interest to our study were done during this period.

During their investigation, 4 conducted a comprehensive survey of the latest intrusion detection systems designed specifically for IoT systems. The study focused on the methods, features, and methods implemented in each study while providing insights into the various architectures used in IoT and some emerging vulnerabilities. The authors also looked at factors that affect the performance of IDS in intelligent environments. Some factors identified were detection accuracy, false positive rate, energy consumption, processing time, and the overall performance overhead.

In their research, 5 also presented a review of IDS for IoT environments, focusing on the techniques and deployment strategies used by each of the studies included in their work. The authors also considered the validation strategies and the datasets used in the respective works covered in their studies. Moreover, the study discussed some challenges facing intrusion detection in IoT systems.

In their work, 6 presented a survey that captures the practices and challenges facing intrusion detection systems in the internet of things. Benkhelifa et al. ⁶ considered various IDS solutions used in IoT environments in their work. Each solution identified in the study was considered an improvement strategy to improve the detection methods.

Mishra et al. ⁷ presented a study that compares models that detect and prevent distributed denial of service attacks. The study also discussed the different classifications of methods, models, and datasets used to build IDS. The study also looked at research challenges in IDS and proposed some solutions to mitigate these challenges. The authors presented some areas that can be considered studies for the future.

In their study, 8 provided an overview of the current security challenges of the IoT and how these challenges can be solved using IDS. The study also explored future challenges in IoT and how they can be addressed using intrusion detection.

In a similar study, 9 presented a review of machine learning-based intrusion detection systems in IoT environments, discussing various Machine Learning (ML) approaches used in designing IDS with emphasis on their advantages and disadvantages. The authors concluded their study by looking at some of the research challenges and possible future direction for work around IDS in IoT.

Arshad et al. ¹⁰ conducted a comprehensive study on existing intrusion detection systems for IoT systems using three parameters, namely, computational overhead, energy consumption, and privacy implications. The study also identified some open challenges that exist in the area of their study.

In another study, 11 conducted a systematic review of the literature to examine existing works in anomaly-based intrusion detection that use deep learning techniques. The study also discussed the challenges faced by DL-based anomaly detection in the IoT domain and some areas that can be considered for future work.

Similarly, 1 conducted a survey of intrusion detection in IoT environments with a focus on the detection methods, placement strategy, security threats, and validation strategy.

Seyfollahi et al. ¹² reviewed machine learning techniques used in designing intrusion detection systems for the Low-Power and Lossy Networks (RPL) protocol. The study also identified open issues and challenges related to their study’s domain.

In their study, 13 showed an overview of intrusion detection systems for IoT networks and presented some suggestions for future work that could help make IoT networks more secure.

Chaabouni et al. ¹⁴ also conducted a survey that sought to classify IoT security threats and challenges. The study analyzed and compared the state-of-the-art NIDS in the context of IoT networks. The study considered the architecture, detection methodologies, validation strategies, and deployed algorithms.

Saranya et al. ¹⁵ evaluated the performance analysis of machine learning models used in the design of IDS for IoT systems. Besides the fact that none of the surveys or SLRs considered incremental ML-based IDSs in their studies, these studies had other gaps which have been considered in our study.

A summary of the related literature is shown in Table 1 below.

In this section, we outlined this study’s method deployed by 2, 3. We used general principles in conducting systematic reviews. The methodology proposed by 2 and 3 has five steps as follows:

In this section, we present the results of the systematic literature review carried out.

In this section, we present some challenges we identified based on the analysis of our study. To begin with, we found out that 2 of the IoT-based studies used datasets (NSL-KDD and KDD CUP 99) that are no longer relevant when designing modern-day IDS.

Additionally, these datasets are non-IoT-based. Therefore, we recommend that future work use datasets from IoT environments to build and evaluate IDS for IoT systems. Secondly, from our studies, we discovered that seven (7) studies out of the 8 IoT-based studies designed lightweight IDS for IoT systems. However, only one reported on the proposed system’s memory consumption, and three (3) reported on the running time of the proposed methods. Only one study reported the computational complexity of the model used in designing their proposed IDS.

Additionally, in designing lightweight IDSs for IoT systems, parameters such as time and space complexity and power consumption of the proposed IDS should be evaluated. The portability of an IoT-based IDS is as important as its accuracy, precision, or recall. Therefore, we propose that future work include a performance matrix that measures the time and space complexity and power consumption of the proposed methods. Additionally, none of the IoT-based studies considered in this work deployed the proposed IDS on an IoT device. It is crucial not only to model IDSs for IoT ecosystems but these IDS models should be deployed on IoT devices. Deploying these models on real devices will help to evaluate parameters such as space complexity and energy consumption. Deployment models on real devices help to evaluate the model’s performance on drift adaptation and determine the model’s accuracy in production environments. We recommend that future studies on IDS for IoT systems incorporate model deployment on physical devices to evaluate how these models will perform in production environments.

Concept Drift in Machine Learning refers to a situation in which the statistical properties of the target variable change over time. In other words, the meaning of the input data used to train the model has changed significantly over time, but the model in production is unaware of the change and thus cannot make accurate predictions. Although incremental machine learning has the advantage of detecting concept drifts, only 2 out of 8 IoT-based studies considered in this work considered concept drift adaption in their studies. Network traffic is usually dynamic, and attackers try to circumvent IDSs by changing the attack signatures of knowns, which leads to a change in the target variable. Future IDSs for the IoT ecosystem must focus on how to build IDSs that can detect drifts and learn from those drifts with minimal human intervention.

Furthermore, the datasets used in the IoT-based studies and most datasets used in modeling IDSs are imbalanced, which gives these models higher accuracy but lower precision. To solve this challenge, more studies can be conducted on creating balanced datasets from IoT systems. Moreover, unlike traditional computing IDSs, which primarily focus on detection speed, precision, and accuracy, IDSs for the IoT ecosystem need a balance between accuracy, speed, precision, lightweight, and low energy consumption. Therefore, researchers must look at these parameters holistically to ensure that proposed IDSs for IoT systems can be deployed in such environments. It is recommended that future work in this domain should focus on using models that are not computationally intensive in designing IDSs for IoT systems.

Finally, the results from the various experimental validations done in IoT-based studies considered in this SLR show that incremental learning is capable of achieving the lightweight IDS status that most IDS problems in IoT systems seek to attain. However, more studies need to be done using the approach mentioned above in the IoT ecosystem to determine the viability of incremental learning to solve the problem of high speed, high accuracy, low energy, and minimal space complexity IDS for IoT systems.

Validity threats hampered the data extraction process and the quality assessment of the papers chosen for this SLR protocol. Using the threats identified by 40, we divided the threats into validity. Internal, external, construct, and conclusion validity are the threats identified by 40. Each of the threats is briefly described in the preceding paragraphs.

This study comprehensively analyzed incremental machine learning-based intrusion detection systems in the internet of things. The aim of the study was to help us understand existing work in the domain of our study and provide suggestions on how future work in IDS for IoT systems can be enhanced. The Internet of Things (IoT) has not only become a household name through its application in smart homes but has also been used in domains like agriculture, healthcare, transportation, and cities and grid systems. Whereas the advantages of IoT cannot be downplayed; its computational constraints make it difficult to deploy security methodologies that have been deployed in traditional computing systems. The study examined the existing state-of-the-art incremental machine learning approaches used to design lightweight intrusion detection systems for IoT environments, as well as the datasets used and how these studies are designing IDS without overburdening IoT device computational resources. As the number of things connected to the internet increases, researchers must use various methods to ensure the security of these things. The application of ML and DL in intrusion detection has proven to be an effective mitigation strategy on traditional computers, and the trend of current research shows that it will become an effective mitigation strategy in detecting intrusions in IoT environments.