# A Comparative Analysis of Anomaly Detection Methods in IoT Networks: An Experimental Study
## 2 Related Work in Anomaly Detection for IoT Networks
### Selected Methods for IoT Anomaly Detection: A Review  
The growth of the IoT has led to a significant increase in the amount and complexity of data generated. Given this trend, securing IoT systems requires the implementation of anomaly detection mechanisms. ML algorithms enable the identification of deviations from normal operation, enabling the proactive detection of potential threats and optimization of network performance [7; 9]. In this section, we will look at various ML-based approaches that have been successfully applied to detect anomalies in IoT networks. These include the following:  
* Random Forest (RF): This method involves building a set of multiple decision trees, which are then combined to produce more accurate and generalizable predictions. Introducing randomness into the tree-building process avoids overfitting the model and increases its robustness to noise in the data [13; 14]. Due to their robustness to overfitting, Random Forests are often used for anomaly detection [15; 16]. In anomaly detection, RFs exploit the principle that observations that deviate from typical patterns will result in inconsistent predictions across decision trees. That is, if a given observation is an anomaly, the individual trees in the RF will classify it differently. This discrepancy in predictions is an alarm signal that enables the identification of anomalies [17; 18; 19; 20; 21]. * Isolation Forest: This operates on the principle of isolating anomalies. It calculates the average path length required to isolate a data point in a tree. Anomalies are easier to isolate as they are found on shorter paths [7; 22]. * Gradient Boosting (GB) and eXtreme Gradient Boosting(XGBoost): These create models sequentially, with each successive model correcting the errors of the previous one. XGBoost is an advanced implementation of Gradient Boosting that introduces a number of optimizations, increasing performance and accuracy [11; 20]. * K-Nearest Neighbors (K-NN): This operates on an intuitive principle: classifying a new data point based on its k nearest neighbors. If a majority of a data point's nearest neighbors belong to a specific class, it is likely that the new data point does as well. For anomaly detection, data points with a sparse neighborhood are often flagged as anomalies. The K-NN algorithm can be effectively applied to anomaly detection in IoT networks, especially for low-dimensional data. Despite its limitations, especially for large and high-dimensional datasets, its intuitiveness and ease of implementation make it a popular choice [16; 17; 19]. * Bayesian Networks (BNs): These are visual representations of probabilistic dependencies between variables. They excel in modeling complex systems with causal relationships. In anomaly detection, BNs can be employed to identify unusual patterns in variable combinations [16; 18; 19; 20]. * Naive Bayes (NB): This is a simpler version of the BN, which assumes that all features are independent of each other, simplifying the calculation. Despite this simplification, the NB method often gives good results in practice [16; 18; 19; 20]. * Linear regression (LR): Although originally applied to binary classification problems, logistic regression can also be used to detect anomalies. By modeling the probability of belonging to a given class, LR allows the identification of observations that are unlikely to belong to a given class (e.g., 'normal' and 'anomalous' classes) [16; 18; 20]. * Support Vector Machine (SVM): This is known for its accuracy and ability to handle high-dimensional data. However, it can be computationally expensive for large datasets [17; 19]. It should be noted, however, that these methods have their limitations, including computational expenses and the requirement of selecting a suitable kernel [16; 20]. * Decision Trees (DTs): These are tree-like structures that make decisions based on a series of tests. Each node in the tree represents a test on a particular variable, and the branches represent possible test results.