# Defense and Security Mechanisms in the Internet of Things: A Review
## 6 Discussion
\begin{table}
\begin{tabular}{l l} \hline \hline
**Reference** & **Method, AI Techniques, Environment with Datasets and Key Results or Findings** \\ \hline
[148] & \(\bullet\)  Anomaly detection \\  & \(\bullet\)  RF, KNN, SVM, and Multi-Layer Perceptron \\  & \(\bullet\)  Medical IoT, ICU-IOMT dataset, and the WUSTL EHMS 2020 \\  & \(\bullet\)  Higher model performance measures compared to separately used SVM, RF, and KNN \\ \hline
[149] & \(\bullet\)  anomaly detection \\  & \(\bullet\)  Machine learning using unsupervised learning \\  & \(\bullet\)  IoT, open-source datasets from Kaggle \\  & \(\bullet\)  Broad detection spectrum, large data requirements \\ \hline
[150] & \(\bullet\)  Cyber-attack detection \\  & \(\bullet\)  Ensemble Bagged Trees detection \\  & \(\bullet\)  Industrial IoT \\  & \(\bullet\)  Better results than other models, suitable for large scale, optimising features, detecting different types of attacks \\ \hline
[151] & \(\bullet\)  Attack detection for Shallow Neural Network \\  & \(\bullet\)  IoT, CIC-IDS2017 \\  & \(\bullet\)  High efficiency, reduction of false negative detections \\ \hline
[152] & \(\bullet\)  TF-IDF methodology to convert categorical data into numeric classification, avoiding data reduction and optimising storage \\  & \(\bullet\)  Unsupervised learning \\  & \(\bullet\)  Evaluated on multiple IoT malware datasets \\  & \(\bullet\)  Accuracy rates: 95.22\%, 96.23\%, 98.77\%, and 99.56\%, minimized information loss by avoiding feature shedding \\ \hline
[154] & \(\bullet\)  FCGs, GNNs, graph pruning for reduced complexity, semantic embedding of APIs using word2 vec \\  & \(\bullet\)  Used Android malware datasets \\  & \(\bullet\)  Focus on semantic attribute extraction from FCGs \\  & \(\bullet\)  F1-score: 98\% for binary classification; 96\% for family classification \\  & \(\bullet\)  Enhanced feature representation and model efficiency \\ \hline
[159] & \(\bullet\)  Hybrid approach combining CNN, LSTM, and PCA for malware detection \\  & \(\bullet\)  Used public malware dataset \\  & \(\bullet\)  Improved precision, recall, accuracy, and F1-scores. Substantial reduction in time and resources for manual analysis \\ \hline
[160] & \(\bullet\)  CIL, multimodal learning \\  & \(\bullet\)  Large-scale Android malware dataset created for TIML, available in open repository \\  & \(\bullet\)  Enhanced classification accuracy for emerging threats; demonstrated resource-efficient approaches \\ \hline \hline \end{tabular}
\end{table} 
Table 8: _Cont._In particular, RF and LSTM were included based on their ability to work with big datasets and efficiently perform classification tasks. GNNs have been selected because they can work on graph-structured data and are promising in detecting more complex attack patterns. As a classical model, SVM is a reference point and allows for comparing results with more modern approaches. It is key for assessing essential parameters such as precision, sensitivity, F1-score, and false alarm rate for their use in large-scale analysis. The findings from the conducted studies are shown in Table 9, which contrasts the obtained results with those reported in the reviewed literature. The analysis of these results indicates that the selected methods, such as using Random Forest and LSTM algorithms in IDSs, show higher effectiveness than classical methods, such as SVM. For example, RF-based models obtained the highest F1-score value on the IoTID20 set, which indicates their high ability to balance precision and sensitivity. In turn, the methods using GNN algorithms achieved lower values for some metrics, which suggests the need for further optimisation in the context of IoT. These studies emphasise that selecting the appropriate model should depend on the data's specificity and the system's requirements, which creates room for further experiments and improvements. Furthermore, detecting anomalies in large systems, such as IoT, requires scalable algorithms to process enormous volumes of real-time data.