# IoT Anomaly Detection to Strengthen Cybersecurity in the Critical Infrastructure of Smart Cities
## 2 Materials and Methods
### Data Preparation  
Data preparation is crucial in implementing a machine learning-based anomaly detection system. This work used data sets collected by IoT devices in a city. Figure 1 presents the stages considered for data preparation. Data was collected from multiple IoT sources distributed across a city over six months. Data sources included electric energy meters installed in homes and businesses in the city, which recorded electricity consumption at 15-min intervals. Water quality sensors distributed throughout the city's water supply network continuously monitored water quality regarding contaminants, turbidity, and pH. IoT security cameras at critical intersections and public areas capture images and videos in real time [27]. In addition, traffic and transportation sensors are installed on roads and public vehicles that collect data on traffic flow, speed, and movement patterns. The total volume of data collected during the six months exceeded five terabytes, representing a large amount of information about the functioning of the smart city and its critical infrastructure. The collected data undergoes cleaning to remove outliers, missing data, and noise. Data cleansing ensures that input data is consistent and of high quality [28]. The data is integrated into a real-time data platform that enables the ingestion and processing of data streams from IoT devices in real time. This platform is based on fog computing technologies to analyze data at the point where it is generated efficiently. The data cleaning and preparation process ensures the quality and consistency of data sets collected from multiple sources of IoT devices in a smart city. Specific tools and  
Figure 1: Stages for presenting data in a smart city environment with IoT. software widely recognized in data processing are used to carry out this task, highlighting Python along with the Pandas and Scikit-Learn libraries. Firstly, Python was selected as the primary programming language due to its versatility and robustness in data analysis. The Pandas and Scikit-Learn libraries play a crucial role in the data preparation process. Pandas enable efficient raw data loading and make it easy to manipulate, including identifying and removing outliers, managing missing data, and normalizing features to ensure they all have the same scale [29]. Additionally, Pandas makes it possible to combine and integrate data from different IoT sources, resulting in a cohesive data set ready for processing. Regarding feature engineering, additional processes were applied to improve data quality and usefulness. This includes extracting relevant features from the raw data, such as temporal patterns, trends, and descriptive statistics. These additional features are carefully selected to reflect crucial aspects of the critical infrastructure IoT devices monitor in real time. Feature engineering plays an essential role in the subsequent effectiveness of anomaly detection algorithms by allowing models to more accurately and efficiently learn the routine and anomalous patterns present in the data [30]. A small sample of the types of data used in the study is presented in Table 1. The table records electric energy meter data, including timestamps, meter identifiers, and kilowatt-hours (kWh) energy consumption at 15-min intervals. The data were normalized and scaled to ensure all characteristics were on the same scale. This is essential for the effective functioning of machine learning algorithms. The data set was split into training and test sets in a ratio of 80/20. The training set was used to train the anomaly detection models, while the test set was used to evaluate the performance of the models. Additionally, feature analyses were performed to identify the most relevant features for anomaly detection. This helps reduce the data's dimensionality and improve the models' efficiency. Significantly, this study was based on collecting and processing data collected by IoT devices distributed in a smart city.