# IoT Anomaly Detection to Strengthen Cybersecurity in the Critical Infrastructure of Smart Cities
## 2 Materials and Methods
### Algorithm Selection  
Algorithms are carefully chosen based on their ability to address the specific challenges of anomaly detection in IoT data. Among the algorithms considered, the Isolation Forest algorithm is considered due to its ability to efficiently detect anomalies in large data sets, such as those collected in a smart city [31]. This algorithm uses the idea that anomalies are outlier points that are easier to isolate in a decision tree. Isolation Forest creates multiple decision trees and measures how many steps are necessary to isolate an instance. The fewer steps are needed, the more likely the model is to be an anomaly.  
Recurrent neural networks (RNNs) are used due to their ability to model temporal data sequences, which is essential when working with evolving IoT data. These neural networks can capture complex patterns and temporal dependencies in data, making them suitable for anomaly detection in time series [32]. Variational autoencoders (VAEs) are  
\begin{table}
\begin{tabular}{c c c} \hline
**Timestamp** & **ID Meter** & **Energy Consumption (kWh)** \\ \hline
1 January 2023 00:00:00 & M001 & 23.45 \\
1 January 2023 00:15:00 & M002 & 18.62 \\
1 January 2023 00:30:00 & M003 & 25.18 \\
1 January 2023 00:45:00 & M004 & 21.37 \\ \hline \end{tabular}
\end{table}
Table 1: Record of energy consumption in IoT devices.  
used to learn a latent representation of the data, enabling anomaly detection by identifying points that do not fit well with the known latent distribution. This approach is practical when dealing with IoT data, where anomalies can be subtle and complex to detect using traditional methods.  
In addition to the abovementioned algorithms, generative adversarial neural networks (GANs) and transformer neural networks (e.g., BERT) are also explored and evaluated for anomaly detection in IoT data. These algorithms have shown promise in anomaly detection applications in time series and unstructured data.  
Table 2 presents an overview of the characteristics of the selected algorithms and how they are applied to detecting anomalies in IoT data in a smart city. The choice of algorithms was based on their suitability to address the specific challenges of the study and their demonstrated effectiveness in similar applications.  
Each of these algorithms was applied in conjunction with the prepared data, for which models based on Isolation Forest, RNN, and VAE were trained using the training set, and their hyperparameters were adjusted to optimize performance. These models were then used to evaluate and detect anomalies in the test set [33]. The selection of these algorithms was based on their demonstrated effectiveness in detecting abnormalities in IoT data, their ability to handle temporal data, and their suitability to address the specific challenges of the study in a smart city.  
Within the framework of this study, the variables and hyperparameters necessary for implementing the anomaly detection algorithms were carefully established. The variables included data collected from IoT devices, such as electrical energy consumption, water quality, security camera images, and traffic data. In addition, specific hyperparameters were defined for each algorithm, such as the depth of the forest in the Isolation Forest, the number of layers and units in the RNNs, and the parameters of the VAEs. The selection and tuning of these variables and hyperparameters are carried out based on iterative experiments and cross-validation techniques to optimize the performance of anomaly detection models [34].