# A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data
###### Abstract  
Anomaly detection has gained considerable attention in the past couple of years. Emerging technologies, such as the Internet of Things (IoT), are known to be among the most critical sources of data streams that produce massive amounts of data continuously from numerous applications. Examining these collected data to detect suspicious events can reduce functional threats and avoid unseen issues that cause downtime in the applications. Due to the dynamic nature of the data stream characteristics, many unresolved problems persist. In the existing literature, methods have been designed and developed to evaluate certain anomalous behaviors in IoT data stream sources. However, there is a lack of comprehensive studies that discuss all the aspects of IoT data processing. Thus, this paper attempts to fill this gap by providing a complete image of various state-of-the-art techniques on the major problems and core challenges in IoT data. The nature of data, anomaly types, learning mode, window model, datasets, and evaluation criteria are also presented. Research challenges related to data evolving, feature-evolving, windowing, ensemble approaches, nature of input data, data complexity and noise, parameters selection, data visualizations, heterogeneity of data, accuracy, and large-scale and high-dimensional data are investigated. Finally, the challenges that require substantial research efforts and future directions are summarized. anomaly detection; data stream; deep learning; Internet of Things; machine learning +
Footnote †: journal: 8 June 2021  
outliers, anomalies, cyber-attack, novelties, exceptions, deviations, surprises, or noise [7,8], where outliers are the data points that are considered out of the ordinary. Detection of these points can be done using outlier detection methods [9]. The anomalies are a special kind of outlier that has actionable pieces of information which could be meaningful. To detect these points, anomaly detection methods are used [10]. Similarly, fault detection is used to detect noise, which is unwanted, and wrong data that has to be removed [11]. Cyber attacks, on the other hand, are more sophisticated; they can be hidden between the data points and hard to detect [12]. Figure 1 illustrates the difference between the above-mentioned terms. In many cases, IoT real-time applications generate infinitely massive data streams that pose impose unique limitations and obstacles to machine learning algorithms [13]. These challenges require a careful design of the algorithm to process these data [14]. Most existing data stream algorithms are less efficient and have limited capability requirements [15]. Many studies have investigated the techniques used for anomaly detection, such as [16, 17, 18, 19] that address static data and data stream using both statistical and machine learning methods. However, these studies have not focused on evolving data streams. Some studies have focused on the detection of anomalies in the data stream, such as [16]. However, previous studies have not addressed all the requirements that have to be available in the algorithm to process IoT data streams and the main challenges for choosing an excellent algorithm that suits the IoT data characteristics. For anomaly detection, many algorithms can be used to detect anomalies in the data stream. A good anomaly detection algorithm should consider the following restrictions related to data streams:  
* Data points are pushed out continuously, and the speed of arrival of data depends on the data source. Thus, it could be fast or slow. * The data stream could be potentially infinite, which means there could be no end to the incoming data. * Features and/or characteristics of the arriving data points may evolve. * Data points are potentially one-pass, i.e., the data points can be used only once, and discarded after. Thus, fetching important data characteristics is important.