journal article·2021-06-08Open access

A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data

Redhwan Al-amri, Raja Kumar Murugesan, Mustafa Man, Alaa Fareed Abdulateef, Mohammed A. Al-Sharafi, Ammar Ahmed Alkahtani

Applied Sciences· Volume 11· Issue 12

Abstract

Anomaly detection has gained considerable attention in the past couple of years. Emerging technologies, such as the Internet of Things (IoT), are known to be among the most critical sources of data streams that produce massive amounts of data continuously from numerous applications. Examining these collected data to detect suspicious events can reduce functional threats and avoid unseen issues that cause downtime in the applications. Due to the dynamic nature of the data stream characteristics, many unresolved problems persist. In the existing literature, methods have been designed and developed to evaluate certain anomalous behaviors in IoT data stream sources. However, there is a lack of comprehensive studies that discuss all the aspects of IoT data processing. Thus, this paper attempts to fill this gap by providing a complete image of various state-of-the-art techniques on the major problems and core challenges in IoT data. The nature of data, anomaly types, learning mode, window model, datasets, and evaluation criteria are also presented. Research challenges related to data evolving, feature-evolving, windowing, ensemble approaches, nature of input data, data complexity and noise, parameters selection, data visualizations, heterogeneity of data, accuracy, and large-scale and high-dimensional data are investigated. Finally, the challenges that require substantial research efforts and future directions are summarized.
Source: crossref · Quality: baseline

Research context

OpenAlex topics: Anomaly Detection Techniques and Applications · Time Series Analysis and Forecasting · Network Security and Intrusion Detection

SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.

Affiliations

School of Computer Science and Engineering, Taylor’s University, Subang Jaya 47500, Selangor, Malaysia

Faculty of Ocean Engineering Technology & Informatics, Universiti Malaysia Terengganu (UMT), Kuala Nerus 21030, Terengganu, Malaysia

School of Computing, Universiti Utara Malaysia, Sintok 06010, Kedah, Malaysia

Department of Information Systems, Azman Hashim International Business School, Universiti Teknologi Malaysia, Skudai 81310, Johor, Malaysia

Institute of Sustainable Energy (ISE), Universiti Tenaga Nasional (UNITEN), Kajang 43000, Malaysia

Funding

Universiti Malaysia Terengganu

References (75)

Show source-provided references
1. A Roadmap Toward the Resilient Internet of Things for Cyber-Physical Systems10.1109/ACCESS.2019.2891969 ↗
2. An Intelligent Outlier Detection Method with One Class Support Tucker Machine and Genetic Algorithm Toward Big Sensor Data in Internet of Things10.1109/TIE.2018.2860568 ↗
3. A novel countermeasure technique for reactive jamming attack in internet of things10.1007/s11042-018-6684-z ↗
4. IoT, big data and artificial intelligence in agriculture and food industry
5. DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series10.1109/ACCESS.2018.2886457 ↗
6. Analysis study on R-Eclat algorithm in infrequent itemsets mining
7. Machine learning for internet of things data analysis: A survey10.1016/j.dcan.2017.10.002 ↗
8. Multivariate anomaly detection for ensuring data quality of dendrometer sensor networks10.1016/j.compag.2019.04.018 ↗
9. An outlier detection approach in large-scale data stream using rough set10.1007/s00521-019-04421-4 ↗
10. I-Eclat: Performance enhancement of Eclat via incremental approach in frequent itemset mining
11. Chakraborty, T., Nambi, A.U., Chandra, R., Sharma, R., Swaminathan, M., Kapetanovic, Z., and Appavoo, J. (2018, January 4–7). Fall-curve: A novel primitive for IoT Fault Detection and Isolation. Proceedings of the 16th ACM Conference on Embedded Networked Sensor Systems, Shenzhen, China.10.1145/3274783.3274853 ↗
12. Detecting cyber-physical attacks in CyberManufacturing systems with machine learning methods10.1007/s10845-017-1315-5 ↗
13. Kozitsin, V., Katser, I., and Lakontsev, D. (2021). Online Forecasting and Anomaly Detection Based on the ARIMA Model. Appl. Sci., 11.10.3390/app11073194 ↗
14. Yu, K., Shi, W., and Santoro, N. (2020). Designing a Streaming Algorithm for Outlier Detection in Data Mining—An Incrementa Approach. Sensors, 20.10.3390/s20051261 ↗
15. Real-time anomaly detection based on long short-Term memory and Gaussian Mixture Model10.1016/j.compeleceng.2019.106458 ↗
16. A Survey on Anomaly detection in Evolving Data [with Application to Forest Fire Risk Prediction]10.1145/3229329.3229332 ↗
17. Donevski, M., and Zia, T. (2018, January 9–13). A Survey of Anomaly and Automation from a Cybersecurity Perspective. Proceedings of the 2018 IEEE Globecom Workshops (GC Wkshps), Abu Dhabi, United Arab Emirates.10.1109/GLOCOMW.2018.8644456 ↗
18. Real-time big data processing for anomaly detection: A Survey10.1016/j.ijinfomgt.2018.08.006 ↗
19. Anomaly Detection, Analysis and Prediction Techniques in IoT Environment: A Systematic Literature Review10.1109/ACCESS.2019.2921912 ↗
20. Baydargil, H., Park, J.-S., and Kang, D.-Y. (2021). Anomaly Analysis of Alzheimer’s Disease in PET Images Using an Unsupervised Adversarial Deep Learning Model. Appl. Sci., 11.10.3390/app11052187 ↗
21. ECG anomaly class identification using LSTM and error profile modeling10.1016/j.compbiomed.2019.04.009 ↗
22. Shanthamallu, U.S., Spanias, A., Tepedelenlioglu, C., and Stanley, M. (2017, January 27–30). A Brief Survey of Machine Learning Methods and their Sensor and IoT Applications. Proceedings of the 2017 8th International Conference on Information, Intelligence, Systems & Applications (IISA), Larnaca, Cyprus.10.1109/IISA.2017.8316459 ↗
23. Machine learning algorithms for wireless sensor networks: A survey
24. An evolving approach to data streams clustering based on typicality and eccentricity data analytics10.1016/j.ins.2019.12.022 ↗
25. Evolving clustering algorithm based on mixture of typicalities for stream data mining10.1016/j.future.2020.01.017 ↗
26. Real-time anomaly detection with Bayesian dynamic linear models10.1002/stc.2404 ↗
27. Song, L., Liang, H., and Zheng, T. (2019, January 3–5). Real-Time Anomaly Detection Method for Space Imager Streaming Data Based on HTM Algorithm. Proceedings of the 2019 IEEE 19th International Symposium on High Assurance Systems Engineering (HASE), Hangzhou, China.10.1109/HASE.2019.00015 ↗
28. Short-long term anomaly detection in wireless sensor networks based on machine learning and multi-parameterized edit distance10.1016/j.inffus.2018.11.010 ↗
29. Hierarchical Edge Computing: A Novel Multi-Source Multi-Dimensional Data Anomaly Detection Scheme for Industrial Internet of Things10.1109/ACCESS.2019.2930627 ↗
30. Detection of evolving concepts in non-stationary data streams: A multiple kernel learning approach10.1016/j.eswa.2017.08.033 ↗
31. Manzoor, E., Lamba, H., and Akoglu, L. (2018, January 19–23). xStream: Outlier Detection in Feature-Evolving Data Streams. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, London, UK.10.1145/3219819.3220107 ↗
32. Farshchi, M., Weber, I., Della Corte, R., Pecchia, A., Cinque, M., Schneider, J.-G., and Grundy, J. (2018, January 10–14). Contextual anomaly detection for a critical industrial system based on logs and metrics. Proceedings of the 2018 14th European Dependable Computing Conference (EDCC), Iasi, Romania.10.1109/EDCC.2018.00033 ↗
33. Bose, B., Dutta, J., Ghosh, S., Pramanick, P., and Roy, S. (2018, January 23–24). D&RSense: Detection of Driving Patterns and Road Anomalies. Proceedings of the 2018 3rd International Conference on Internet of Things: Smart Innovation and Usages (IoT-SIU), Bhimtal, India.10.1109/IoT-SIU.2018.8519861 ↗
34. Detecting performance anomalies in scientific workflows using hierarchical temporal memory10.1016/j.future.2018.05.014 ↗
35. Unsupervised real-time anomaly detection for streaming data10.1016/j.neucom.2017.04.070 ↗
36. Fully online clustering of evolving data streams into arbitrarily shaped clusters10.1016/j.ins.2016.12.004 ↗
37. MuDi-Stream: A multi density clustering algorithm for evolving data stream10.1016/j.jnca.2014.11.007 ↗
38. Janakiraman, V.M., and Nielsen, D. (2016, January 24–29). Anomaly detection in aviation data using extreme learning machines. Proceedings of the 2016 International Joint Conference on Neural Networks (IJCNN), Vancouver, BC, Canada.10.1109/IJCNN.2016.7727444 ↗
39. An anomaly detection framework for time-evolving attributed networks10.1016/j.neucom.2020.04.047 ↗
40. Qiu, J., Du, Q., and Qian, C. (2019). KPI-TSAD: A Time-Series Anomaly Detector for KPI Monitoring in Cloud Applications. Symmetry, 11.10.3390/sym11111350 ↗
41. Threaded ensembles of autoencoders for stream learning10.1111/coin.12146 ↗
42. Long-range forecasting in feature-evolving data streams10.1016/j.knosys.2020.106405 ↗
43. Identifying data streams anomalies by evolving spiking restricted Boltzmann machines10.1007/s00521-019-04288-5 ↗
44. Spatiotemporal Anomaly Detection Using Deep Learning for Real-Time Video Surveillance10.1109/TII.2019.2938527 ↗
45. Hundman, K., Constantinou, V., Laporte, C., Colwell, I., and Soderstrom, T. (2018, January 19–23). Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining 2018, London, UK.10.1145/3219819.3219845 ↗
46. A multi-stage anomaly detection scheme for augmenting the security in IoT-enabled applications10.1016/j.future.2019.09.038 ↗
47. Anomaly Detection for IoT Time-Series Data: A Survey10.1109/JIOT.2019.2958185 ↗
48. Goldstein, M., and Uchida, S. (2016). A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data. PLoS ONE, 11.10.1371/journal.pone.0152173 ↗
49. Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches10.1016/j.iot.2019.100059 ↗
50. CLAPP: A self constructing feature clustering approach for anomaly detection10.1016/j.future.2016.12.040 ↗
51. Motor Anomaly Detection for Unmanned Aerial Vehicles Using Reinforcement Learning10.1109/JIOT.2017.2737479 ↗
52. ADF: An Anomaly Detection Framework for Large-Scale PM2.5 Sensing Systems10.1109/JIOT.2017.2766085 ↗
53. Luo, H., and Zhong, S. (2017, January 9–12). Gas turbine engine gas path anomaly detection using deep learning with Gaussian distribution. Proceedings of the 2017 Prognostics and System Health Management Conference (PHM-Harbin) 2017, Harbin, China.10.1109/PHM.2017.8079166 ↗
54. Hajdarevic, A., Dzananovic, I., Banjanovic-Mehmedovic, L., and Mehmedovic, F. (2015, January 25–29). Anomaly detection in thermal power plant using probabilistic neural network. Proceedings of the 2015 38th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), Opatija, Croatia.10.1109/MIPRO.2015.7160443 ↗
55. Distributed attack detection scheme using deep learning approach for Internet of Things10.1016/j.future.2017.08.043 ↗
56. Legrand, A., Niepceron, B., Cournier, A., and Trannois, H. (2018, January 5–7). Study of Autoencoder Neural Networks for Anomaly Detection in Connected Buildings. Proceedings of the 2018 IEEE Global Conference on Internet of Things (GCIoT), Alexandria, Egypt.10.1109/GCIoT.2018.8620158 ↗
57. Anomaly Detection for Road Traffic: A Visual Analytics Framework10.1109/TITS.2017.2675710 ↗
58. Tonchev, K., Koleva, P., Manolova, A., Tsenov, G., and Poulkov, V. (2016, January 27–29). Non-intrusive sleep analyzer for real time detection of sleep anomalies. Proceedings of the 2016 39th International Conference on Telecommunications and Signal Processing (TSP), Vienna, Austria.10.1109/TSP.2016.7760906 ↗
59. Zang, D., Liu, J., and Wang, H. (2018, January 9–11). Markov chain-based feature extraction for anomaly detection in time series and its industrial application. Proceedings of the 2018 Chinese Control and Decision Conference (CCDC), Shenyang, China.10.1109/CCDC.2018.8407286 ↗
60. Adaptive Cluster Tendency Visualization and Anomaly Detection for Streaming Data10.1145/2997656 ↗
61. A Structured Sparse Subspace Learning Algorithm for Anomaly Detection in UAV Flight Data10.1109/TIM.2017.2754698 ↗
62. Han, M.L., Lee, J., Kang, A.R., Kang, S., and Park, J.K. (2015). A Statistical-Based Anomaly Detection Method for Connected Cars in Internet. Internet of Vehicles—Safe and Intelligent Mobility, Springer.10.1007/978-3-319-27293-1_9 ↗
63. Sayed, D., Rady, S., and Aref, M. (2020, January 7–9). Enhancing CluStream Algorithm for Clustering Big Data Streaming over Sliding Window. Proceedings of the 2020 12th International Conference on Electrical Engineering (ICEENG), Cairo, Egypt.10.1109/ICEENG45378.2020.9171705 ↗
64. CorrCorr: A feature selection method for multivariate correlation network anomaly detection techniques10.1016/j.cose.2019.02.008 ↗
65. Unsupervised Anomaly Detection in Stream Data with Online Evolving Spiking Neural Networks10.1016/j.neunet.2021.02.017 ↗
66. Vergeles, A., Khaya, A., Prokopenko, D., and Manakova, N. (2018, January 21–25). Unsupervised Real-Time Stream-Based Novelty Detection Technique an Approach in a Corporate Cloud. Proceedings of the 2018 IEEE Second International Conference on Data Stream Mining & Processing (DSMP), Lviv, Ukraine.10.1109/DSMP.2018.8478490 ↗
67. Stiawan, D., Idris, M.Y., Malik, R.F., Nurmaini, S., and Budiarto, R. (2016, January 5–6). Anomaly detection and monitoring in Internet of Things communication. Proceedings of the 2016 8th International Conference on Information Technology and Electrical Engineering (ICITEE), Yogyakarta, Indonesia.10.1109/ICITEED.2016.7863271 ↗
68. Personalized Maternal Sleep Quality Assessment: An Objective IoT-based Longitudinal Study10.1109/ACCESS.2019.2927781 ↗
69. A holistic review of Network Anomaly Detection Systems: A comprehensive survey10.1016/j.jnca.2018.12.006 ↗
70. Progress in Outlier Detection Techniques: A Survey10.1109/ACCESS.2019.2932769 ↗
71. Big data: Dimensions, evolution, impacts, and challenges10.1016/j.bushor.2017.01.004 ↗
72. Internet of Things security: A survey10.1016/j.jnca.2017.04.002 ↗
73. Deep Multitask Learning for Railway Track Inspection10.1109/TITS.2016.2568758 ↗
74. Santos, J., Leroux, P., Wauters, T., Volckaert, B., and De Turck, F. (2018). Anomaly detection for Smart City applications over 5G low power wide area networks. Proceeding of the NOMS 2018—2018 IEEE/IFIP Network Operations and Management Symposium, Taipei, Taiwan, 23–27 April 2018, IEEE.10.1109/NOMS.2018.8406257 ↗
75. Internet of Things: A survey on machine learning-based intrusion detection approaches10.1016/j.comnet.2019.01.023 ↗