# A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data
## 5 Research Challenges and Future Directions

Table 4: _Cont._ideal for retraining the models, because most of the current approaches use predefined interval timing [66; 67]. 4. Ensemble Approaches  
Another area of growth is ensemble approaches. Ensemble methods are well established for increasing the efficacy of detection anomalies by detecting and running the accuracy of time [41]. Another worthwhile potential course of research would then be the ensemble detection of deviations, which shows great promise in boosting the detection accuracy of the algorithms. More specific models can be recommended for resolving unexplored regions. To detect anomalies within the environment of the data stream, initial attempts to examine the ensemble are recommended. However, this field of study is still unexplored and requires more comprehensive models. 5. Nature of Input Data  
Many existing challenges need to be solved within IoT anomaly detection. As highlighted by [PERSON] et al. [68], labelled data availability is a major issue in IoT anomaly detection because the occurrence of anomalies may not be regular. In addition, obtaining the real system data is complicated and requires a lengthy process to reach the operating system data [19]. A wide gap exists in formalizing obtaining knowledge logs and sensory data flow, developing a model, and validating it in real-life environments. During the study, many experiments have been reported, linked mainly to the usual behavior of the system [19]. The most developed methods are based on normal behavior training, and anything that differs from normal labelled data is considered anomalous. More precise and reliable techniques are required to deal with complicated datasets of real scenarios. In addition, the availability of a suitable dataset for public anomaly detection is generally a key issue for training and validating techniques for real-time anomaly detection [69]. Such datasets must have a wide variety of new normal and abnormal behaviors, and they should be labelled clearly and constantly updated to prevent any new types of abnormal behavioral threats. Most existing datasets for anomaly detection often lack from wrong labelling, poor diversity of attacks, and compatibility with real-time detection [70]. New data sets for anomaly detection demand realistic environments with a variety of normal and abnormal scenarios. Additionally, the fundamental truth that includes anomalies must be produced to increase the credibility of the dataset when testing a new system of anomaly detection. 6. Data Complexity and Noise  
Data complexity, such as imbalanced datasets, unexpected noises, and redundancy within the data, is one of the main challenges in the development of a model for anomaly detection [40]. Well-developed approaches for curating the datasets are required to collect useful information and knowledge. 7. Parameters Selection  
IoT data streams are often generated from non-stationary environments with no advanced information on the data distribution, which affects the choice of a proper set of model parameters for detecting anomalies [25]. 8. Data visualizations  
The visualization of the anomaly analysis has highlighted the existence of a gap. New techniques and solutions are needed for the analysis of visual systems to be implemented. Therefore, these gaps related to the fields of the anomaly detection process should be explored [8]. 9. Heterogeneity of data  
The heterogeneous IoT sensors and devices are sources of an unlimited volume of data streams that demonstrate all types of environmental characteristics, such as light,temperature, humidity, noise, electric current, voltage, power, etc. [28]. Such a data stream requires instant processing for handling timely and critical scenarios, such as healthcare monitoring for a patient and environmental safety monitoring [71]. Every device can transmit data many times per second, and with a large number of connected devices, a typical data processing platform might be necessary for dealing with billions of such incoming events every day [72].