# Defense and Security Mechanisms in the Internet of Things: A Review
## 5 Defense Mechanisms in IoT Environments
### Anomaly and Cyber-Attack Detection Systems  
[PERSON] et al. in [144] introduced an anomaly detection model to tackle the difficulties of identifying anomalies in multivariate time series data inside an IoT context. The proposed model utilises multi-scale discrete wavelet decomposition and a dual graph attention network to extract feature correlations and temporal dependencies. The authors integrated a gated recurrent unit with a multi-head self-attention network to produce prediction and reconstruction outcomes. This solution diminishes the parameter count and enhances the accuracy of anomaly detection. [PERSON] et al. in [145] proposed a methodology for anomaly detection to categorise normal and abnormal usage patterns in an Intrusion Detection System for an Internet of Things environment. The proposed research strategy for the study entails using a hybrid feature selection where a combination of filter-based methods and a wrapper approach is used, coupled with bagging as the final classification technique. The solution received 99.8% accuracy during the testing. [PERSON] et al. in [146] presented an Advanced Hybridized Optimization Technique to deal with cyber-attacks. This method incorporated unsupervised machine learning in the MANET-IoT sensor system. The suggested model incorporates the Genetic Algorithm and Firefly Algorithm to choose secure and best paths for routing while detecting black hole attacks through routing responses. The proposed approach attained 98% accuracy during the evaluations. [PERSON] et al. in [147] suggested a Variance Profile Exploitation method for anomaly detection. This approach employed discrete wavelet transform and k-means clustering. It is initiated with an expedited training phase and perpetually refined by incorporating new data segments. The overlapping data collection during the detection phase reveals correlations between successive data segments, enhancing detection accuracy. The authors utilised the Intel Berkeley Research Lab dataset, which had artificially introduced anomalies, for numerical experimentation. They attained 97% accuracy in the assessments. The authors also state that because the proposed approach has low computing complexity and can detect anomalies in real time with the help of the developed technique, it is suitable for real-time systems that work with big data. [PERSON] et al. in [148] bring together different machine learning models such as Random Forest, K-Nearest Neighbors, Support Vector Machine, and Multi-Layer Perceptron to enhance anomaly detection performance. The results indicate that the proposed method outperforms the conventional machine learning models, including SVM, KNN, and RF, in terms of accuracy, precision, recall, and F1-score for both datasets. The authors also stated that their approach can be helpful in security, health, and other areas that require anomaly detection. [PERSON] et al. in [149] suggested a machine learning approach for anomaly detection in IoT scenarios. The model is designed to provide general detection capabilities where wrong packets are filtered out from inspected data in the ingestion order pipeline to identify abnormalities. The packets suggested in the model also allow for the identification of possible failures of the infrastructure as well as some irregularities in the sensors. Also, the authors noted some issues with the proposed solution, including the fact that it requires a lot of data, and the algorithm has to be trained again for every new configuration. [PERSON] et al. in [150] proposed a cloud-based architecture for cyber-attack detection using the Ensemble Bagged Trees Detection method. This technology identifies the dangerous behaviours and cyber-attack categories for the hyper-automation processes in the IoT environment. The architecture uses a priority-based feature selection and extraction approach to identify the best features derived from network traffic, computation time, malicious activities, and attack types.