From: A critical review of intrusion detection systems in the internet of things: techniques, deployment strategy, validation strategy, attacks, public datasets and challenges
Features extraction is required from the raw data to conduct a classification.
Features extraction is not necessary and the raw data could be used in a completely autonomous to build IDS.
Number of Contents
Only a part of available data is being utilized for building IDS. The data is scaled into a small vector of features, e.g. statistical correlations, it isinevitably throwing away most of the data
Processes all of the data, with a large number of features to detect the intrusions.
Features selected by a human domain expert
Using raw data offers the capability to discover non-linear correlations between data that are too complex for a human expert.