## 6 Results  
### Studies Selection and Quality Assessment  
A total of 2116 records were extracted from the online database (\(n=2106\)) and extra sources (\(n=10\)); after the removal of duplicates (\(n=765\)), 1351 records were subject to primary selection, out of which 714 records were excluded (books, lectures note, conferences and miscellaneous). Accordingly, 637 records were identified as journal articles, out of which 97 records were excluded (reviews, surveys, and reports). Finally, 540 records were subjected to inclusion and exclusion criteria, out of which 43 studies were eligible. However, only 26 studies met the criteria of quality assessment. The 26 studies that fulfill the assessment criteria were selected to extract the data and synthesis of the systemic literature review. Table 2 shows the number of retrieved records from online databases according to the pre-specified keywords. Figure 2 shows the fellow chart of selection studies.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Database Name** & **Keywords** & **Records** & **Total** \\ \hline \multirow{7}{*}{IEEE explore} & \({}^{*}\)Anomaly intrusion detection\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 113 & \\  & \({}^{*}\)Anomaly intrusion detection\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 109 & \\  & \({}^{*}\)Anomaly intrusion detection system\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 96 & \\  & \({}^{*}\)Anomaly intrusion detection system\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 96 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 411 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 442 & \\ \hline \multirow{7}{*}{Science direct} & \({}^{*}\)Anomaly intrusion detection\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 6 & \\  & \({}^{*}\)Anomaly intrusion detection\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 4 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 1 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 188 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 144 & \\ \hline \multirow{7}{*}{Scopus} & \({}^{*}\)Anomaly intrusion detection\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 4 & \\  & \({}^{*}\)Anomaly intrusion detection system\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 4 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 69 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 47 & \\ \hline \multirow{7}{*}{Web of science} & \({}^{*}\)Anomaly intrusion detection\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 3 & \\  & \({}^{*}\)Anomaly intrusion detection\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 2 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 36 & \\  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 22 & \\ \hline \multirow{7}{*}{MDPI} & \({}^{*}\)Anomaly intrusion detection\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 40 & \\  & \({}^{*}\)Anomaly intrusion detection system\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 39 & \\ \cline{1-1}  & \({}^{*}\)Anomaly intrusion detection system\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 20 & \\ \cline{1-1}  & \({}^{*}\)Anomaly intrusion detection system\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 20 & \\ \cline{1-1}  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Internet of things\({}^{*}\) & 90 & \\ \cline{1-1}  & \({}^{*}\)Anomaly-based\({}^{*}\) AND \({}^{*}\)Deep learning\({}^{*}\) & 81 & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Number of retrieved records from online databases according to the pre-specified keywords.