# A Comparative Analysis of Anomaly Detection Methods in IoT Networks: An Experimental Study
###### Abstract
As IoT ecosystems evolve, modern security systems must evolve to stay ahead of increasingly sophisticated cyber threats [8; 9]. The novelty of this approach lies in its exclusive focus on anomaly detection in IoT networks, a highly dynamic and evolving environment where traditional security measures often fail. Unlike other work that may treat anomaly detection as a general concept, this research specifically targets IoT networks, where the diversity of defects and the continuous flow of data present unique challenges. Moreover, this approach is distinguished not only by comparing different ML methods for anomaly detection but also by prioritizing the interpretability and reliability of the results. The focus on interpretability is key as most ML models, especially in a security context, are often criticized for being 'black boxes'. Ensuring that the chosen models are explainable helps build user confidence and enables better IoT security decision-making. This paper presents the following important contributions, which are based on specific design and evaluation decisions:  
* A comprehensive overview of ML methods for anomaly detection in IoT networks: The paper includes detailed descriptions of the Random Forest, Isolation Forest, and Autoencoder methods, as well as other popular algorithms such as neural networks (CNN, RNN, LSTM), Gradient Boosting methods (GB, XGBoost), K-NN, SVMs, and decision trees. The authors discuss the advantages and disadvantages of each of these methods in the context of anomaly detection in IoT networks. * A comparative analysis of the performance of the selected methods on two datasets: This paper presents the results of a study using the IoT-23 and CICIoT-2023 datasets to evaluate the Random Forest, Isolation Forest, and Autoencoder methods in anomaly detection tasks. The authors compare the performance of these methods using different evaluation metrics. * Discussion of the limitations of centralized ML in the context of IoT: The article identifies privacy risks and scalability issues as the main limitations of the centralized approach. The authors emphasize the need to explore alternative solutions that provide data security and computational efficiency for large IoT networks. * The research addresses the limitations of current approaches by proposing future research directions for anomaly detection in IoT, namely, using federated learning to train models on distributed data without compromising privacy, combining rule-based systems and ML to make models more transparent and understandable, using XAI techniques to improve the transparency and reliability of models, conducting comprehensive assessments using different datasets and methods, placing emphasis on data preprocessing and the tuning of hyperparameters for optimal performance, and integrating anomaly detection with automated response mechanisms to mitigate risks. The article is structured as follows. Section 2 delves into anomaly detection in IoT networks. It categorizes anomalies into point, contextual, and collective anomalies, providing examples and visualizations. In addition, it looks at different ML approaches, including supervised, unsupervised, and reinforcement learning for anomaly detection. The section concludes with an overview of popular algorithms such as the Random Forest and Isolation Forest and neural networks, highlighting their strengths and weaknesses in IoT anomaly detection. Section 3 details the research methodology, including data preparation, the selection of suitable ML algorithms, and the subsequent evaluation of the models. Section 4 presents a comparative analysis of several studies focusing on anomaly detection in IoT networks using selected datasets. Furthermore, in this section, the studies mentioned jointly analyzed different preprocessing techniques, feature selection methods, and evaluation strategies, providing valuable insights into the challenges and potential solutions for effective anomaly detection in IoT environments.