# IoT Anomaly Detection to Strengthen Cybersecurity in the Critical Infrastructure of Smart Cities
## 2 Materials and Methods
### Training and Validation Process  
The training and validation process is essential to developing and evaluating effective anomaly detection models in the critical infrastructure of a smart city. For this, the collected data set was divided into two main sets: the training set and the validation set. This split was in an approximately 80/20 ratio, where 80% of the data went to the training set and the remaining 20% to the validation set. This splitting strategy allowed the model to learn  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Algorithm** & **Key Features** & **Application in Anomaly Detection in the IoT** \\ \hline \multirow{3}{*}{Isolation Forest} & Efficient on large data sets. & Detecting anomalies in real-time IoT data streams. \\ \cline{2-3}  & It takes advantage of the idea of isolating anomalies in decision trees. & Identification of anomalous points in sensor \\ \hline \multirow{3}{*}{RNN} & I am modeling temporal data sequences. & Detecting anomalous patterns in time-series IoT \\  & & sensor data. \\ \cline{2-3}  & Capture temporal dependencies in sequence data. & Prediction of device failures based on history. \\ \hline \multirow{3}{*}{VAE} & Learn a latent representation of the data. & Identification of anomalies in IoT data with \\  & & high dimensionality. \\ \cline{2-3}  & Detects points that do not fit well with the & Recognition of unusual behavior in sensor data. \\ \hline \multirow{3}{*}{Current Algorithms (Optional)} & GANs and transformer neural networks for anomaly detection. & Exploration of the latest techniques in anomaly detection in the IoT. \\ \cline{2-3}  & Ability to handle unstructured data and & Application of advanced models to \\ \cline{1-1}  & time series. & improve accuracy. \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of algorithms and their applications in IoT anomaly detection.  
standard behavioral patterns in the training set and to be tested for its ability to detect anomalies in the validation set. Figure 2 presents the process flow used for training and evaluating the models.  
Each selected algorithm was trained with specific hyperparameters that were adjusted during training. For example, in Isolation Forest, the number of trees in the forest and the maximum tree depth were adjusted to optimize anomaly detection capabilities. For RNN, the number of hidden layers, the units in each layer, and the activation function were configured to adapt to the complexity of the temporal sequences of the data. In VAE, hyperparameters related to the autoencoder architecture were defined, such as the number of layers and the size of the latent layer, in addition to VAE-specific parameters, such as the mean and standard deviation in the latent layer.  
Cross-validation techniques were applied to the training set to ensure the robustness of the models. This involves dividing the training set into smaller subsets, training and validating the models on different combinations of these subsets, and averaging the results to evaluate the model's overall performance, as presented in Figure 3. Additionally, off-validation was performed [35]. Sample in the validation set to determine how the models performed on previously unseen data. This helps confirm that the models can generalize and detect anomalies effectively in real-world situations.  
The training and validation process is carried out rigorously, considering both the stratified configuration of the data sets and the optimization of specific hyperparameters for each algorithm. These critical stages ensured that the models were well calibrated and ready for evaluation on the validation set. This provided an accurate assessment of their performance, detecting anomalies in critical smart city infrastructure.