# A Survey on Cybersecurity in IoT
## 5 Artificial Intelligence and Machine Learning in IoT Security  
The integration of AI and ML into IoT security represents a paradigm shift, offering both novel defense mechanisms and enhancing existing cybersecurity frameworks. In the context of IoT, AI and ML are not merely tools for automation but are fundamental in addressing the unique security challenges posed by the complexity, scale, and dynamic nature of IoT environments [202; 203; 204]. One of the most critical applications of AI in IoT security is anomaly detection [205]. Traditional security systems rely on predefined rules and signatures to identify threats [206]. However, IoT networks are characterized by high variability in device behavior, making it difficult to distinguish between normal and malicious activities using static rules. ML algorithms, particularly those employing unsupervised learning, can be trained to recognize patterns in network traffic and device behavior, enabling the detection of anomalies that \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Topic** & **References** & **Summary** \\ \hline Z-Wave Protocol & [159; 175; 176] & Security analysis of Z-Wave, including challenges like DoS attacks and encryption key compromise. \\ \hline LoRaWAN Protocol & [160; 177; 178] & Examines LoRaWAN security challenges, such as session key vulnerabilities and replay attacks. \\ \hline Thread Protocol & [161; 179; 180] & Studies on the Thread protocol, highlighting security through mesh networking and key management. \\ \hline Wi-Fi Security Issues & [162; 181; 182] & Discusses Wi-Fi vulnerabilities such as KRACK attacks and advancements with WPA3 encryption. \\ \hline MQTT Security Issues & [163; 164; 165; 166] & Discussions on security challenges in MQTT, including attacks like MitM and DoS. \\ \hline CoAP Security Enhancements & [167; 168; 169] & Enhancements to CoAP security, including DTLS vulnerabilities and protection methods. \\ \hline Zigbee Security Vulnerabilities & [170; 171; 172] & Exploration of security vulnerabilities in Zigbee networks, such as key extraction and device impersonation. \\ \hline Advanced MQTT Security Mechanisms & [183; 184; 185] & Proposed enhancements to MQTT security through payload encryption and zero-trust architecture. \\ \hline Advanced CoAP Security Mechanisms & [186; 187; 188] & Improvement strategies for CoAP security, such as OSCORE for better key management. \\ \hline Zigbee Quantum-Resistant Cryptography & [189; 190; 191] & Studies on the application of quantum-resistant cryptography in Zigbee networks. \\ \hline SDN Integration with IoT & [192; 193; 194; 195] & Research on integrating SDN with IoT for improved security. \\ \hline Blockchain and IoT & [196; 197; 198] & Use of blockchain technology in IoT to enhance security and integrity. \\ \hline Protocol-Agnostic Security & [199; 200; 201] & Development of security frameworks that are abstracted from specific communication protocols. \\ \hline \end{tabular}
\end{table} 
Table 4: _Cont._may indicate security breaches [207]. Techniques such as clustering, autoencoders, and generative adversarial networks (GANs) are increasingly being employed to identify deviations from normal behavior, which can be indicative of a cyberattack [208; 209; 210]. Moreover, supervised learning models are being utilized to enhance IDS within IoT networks. By training on large datasets that include labeled instances of both normal and malicious activities, these models can classify incoming traffic in real time, improving the accuracy and speed of threat detection [211; 212; 213]. Ensemble methods, which combine the strengths of multiple learning algorithms, have shown particular promise in boosting detection rates while minimizing false positives. Furthermore, the deployment of federated learning techniques allows models to be trained across multiple IoT devices without the need for centralized data collection, preserving privacy while enhancing security [214; 215; 216].