# Anomaly Detection for IOT Systems Using Active Learning
## 2 Literature Review  
The proliferation of IoT devices has experienced a significant upswing in recent years [30], resulting in a substantial upsurge in the volume of data produced by these networked devices. The analysis of this extensive dataset is of the utmost importance for anomaly detection [31; 32], as it facilitates the identification of atypical patterns or behaviors. Therefore, this literature review provides an overview of existing research that primarily focuses on active learning-based algorithms for anomaly detection in IoT systems. Various methodologies have also been investigated in this area. According to [5], the utilization of an attack-specific characteristic, rather than an IoT-specific feature, might enhance the effectiveness and feasibility of a machine learning-based security system for attack detection and anomaly identification. The researchers employed the UNSW-NB15 and NSL-KDD datasets in this study. The performance of a system is evaluated by considering various metrics, including recall, precision, accuracy, F1-score, training time, and testing time. The F1-score of RFs is 0.99, whereas the Support Vector Machine (SVM) has an F1-score of 0.65. The primary aim of this study was to identify different types of attacks. The results obtained demonstrated a high level of accuracy in detecting various attacks, with a low occurrence of false alarms when utilizing the extracted features for this purpose. According to [10], an inquiry was carried out to explore a method for anomaly identification in the context of improving cybersecurity in a smart city. To eliminate potential hazards and improve the overall security of the smart city infrastructure, the researchers used diverse methodologies such as K-Nearest Neighbor (KNN), Logistic Regression (LR), DT, artificial neural network (ANN), and RF. Their paper analyzes ensemble techniques, such as bagging and boosting, to improve the detection the architecture's security. Their research is centered on using two datasets, namely UNSW-NB15 and CICIDS 2017. The results showed that the SVM achieved an accuracy rate of 90.50%. The artificial neural network had a classification accuracy of 79.5%, whereas the boosting approach had an accuracy rate of 98.6%, and the stacking method had an approximate accuracy rate of 98.8%. Therefore, the experimental results acquired using the dataset UNSW-NB15 can be used as a primary lead for identifying infrequent attacks in a smart city's IoT environment. The authors of [14] proposed a comprehensive framework for implementing the Variational Long Short-Term Memory (VLSTM) model, which involves the utilization of both estimation and compression networks. The researchers developed a VLSTM learning model for intelligent anomaly detection. This model utilizes rebuilt feature representations to address the challenge of balancing dimensionality reduction and feature retention in imbalanced Industrial Big Data (IBD) datasets. The experimental findings, encompassing the VLSTM strategy, outperformed six alternative approaches on the testing dataset, as evidenced by an F1-score of 0.907, a False Alarm Rate (FAR) value of 0.117, and an Area Under Curve (AUC) metric of 0.895. The findings demonstrate that, in comparison to baseline methods, their approach can successfully identify true abnormalities from data on typical network traffic and dramatically lower the false anomaly detection rate. In addition, [16] described a new intrusion detection model that could be applied to fog nodes. This model used UNSW-NB15 properties to find superfluous IoT device traffic. This paper presents the tab transformer model, which surpasses machine learning. Said model distinguishes normal from irregular traffic at 98.35% accuracy. However, their approach predicts attacks with 97.22% accuracy across many classes. The model opened up new fog node anomaly study avenues, according to the review [19]. Furthermore, [PERSON] and [PERSON] [20] presented a variety of intrusion detection techniques.