# Defense and Security Mechanisms in the Internet of Things: A Review
## 3 Materials and Methods
### Anomaly and Cyber-Attack Detection  
Anomaly and cyber-attack detection identifies abnormal behaviour and computer system and network threats. It employs various methods for watching, assessing, and handling threats, and some of the most important tools include Intrusion Detection Systems and Intrusion Prevention Systems. For instance, in corporate networks and systems, IDSs and IPSs can oversee the internal and external traffic and thus prevent DDoS attacks, intrusions, and unauthorised access. In addition, IDSs and IPSs can identify threats relevant to Cyber-Physical Systems and crucial industrial processes in smart systems [95; 96]. Anomaly detection aims to recognise activity different from that of regular behaviour that could indicate an attack is in progress. Anomalies can be detected when there are variations from the standard practices that have attempted to set, or gain access to, unusual restricted user areas actions, or sharply increase the in-use network of traffic, machine learning models. These models are usually trained on historical data to determine \"normal\" behaviour and detect deviations from that pattern. Anomaly detection uses the following typical artificial intelligence (AI) methods: Gradient Boosting (GB) [97], Decision Tree (DT) [98], Long Short-Term Memory (LSTM) [99], Convolutional Neural Networks (CNNs) [100], Random Forest (RF) [101], K Nearest Neighbour (KNN) [102], and Support Vector Machines (SVMs) [103]. IPSs are similar to IDSs but are an active solution that detects and prevents threats. IPS stands for Intrusion Prevention System, and it works by monitoring and analysing traffic and taking automatic actions in case of threat detection, for instance, blocking packets, resetting connections, or even isolating the user [23, 104, 105]. The main characteristics of IPSs are the following:  
* Network-based IDS--observes network traffic to detect irregularities such as DDoS attacks, port scanning, intrusion attempts, etc. [106]. * Host-based IDS--observes operating system-level activities, such as unauthorised changes to system files, illegal access to resources, and configuration manipulation [107]. IPSs work similarly to IDSs but are an active system that detects and prevents potential threats. An IPS monitors and analyses traffic and responds automatically to detected threats, for example, blocking packets, resetting connections, or isolating the user [23, 108]. Key IPS features include the following:  
* Detection and blocking--IPS analyses data packets in real time and can immediately block traffic it identifies as malicious. * Responding to attacks on the fly--IPSs can modify or block suspicious traffic before it reaches potential targets. There are differences in how IDSs and IPSs approach threat detection, for example, anomaly detection, where things that are out of the ordinary are identified and signature detection, where threats are matched against known attack patterns. It is also important to note that both systems now incorporate machine learning into their design to process large amounts of data and identify new threats. Identifying anomalies and cyber-attacks through IDSs and IPSs is crucial in protecting modern networks and systems. IDS/IPS, integrated with anomaly detection and machine learning, offer efficient cyber threat identification and prevention before they occur, effectively enhancing security [109]. This section presents the key cryptographic theoretical protocols concepts that govern the security of communications IoT between environments. The topics discussed include symmetric-key encryption, asymmetric-key encryption, hashing functions, and digital signatures. These cryptographic techniques ensure the security of data integrity, confidentiality, and authenticity. Security protocols are also emphasised in pursuing the above goals, and the details of the secure data exchange between devices are given. The section further explores blockchain technology in terms of decentralised security and immutability, which makes it key in trust maintenance in IoT.