# Anomaly Detection for IOT Systems Using Active Learning
###### Abstract  
The prevalence of Internet of Things (IoT) technologies is on the rise, making the identification of anomalies in IoT systems crucial for ensuring their security and reliability. However, many existing approaches rely on static classifiers and immutable datasets, limiting their effectiveness. In this paper, we have utilized the UNSW-NB15 dataset, which contains 45 variables including multi- and binary-target variables, to determine the most relevant properties for detecting abnormalities in IoT systems. To address this issue, our research has investigated the use of active learning-based algorithms for anomaly detection in IoT systems. Active learning is a powerful technique that improves precision and productivity by eliminating the need for labeling and adapting to dynamic IoT environments. Additionally, our study has combined feature engineering methods, active learning approaches, and a random forest classifier to construct a resilient anomaly detection model for IoT devices. The proposed model has outperformed several state-of-the-art techniques, achieving an impressive accuracy rate of 99.7%. By implementing a rigorous sampling procedure and leveraging the collaborative nature of the random forest technique, our model has demonstrated a notable level of precision with a weighted average accuracy of 0.995. The findings of the study offered empirical evidence, supporting the efficacy of our active learning methodology in identifying abnormalities in IoT systems. Moreover, our study provides valuable insights and recommendations for future research and development activities in this field. Overall, this research contributes to the advancement of anomaly detection techniques in IoT systems, further enhancing their security and reliability. anomaly detection; intrusion detection system (IDS); Internet of Things (IoT); active learning; network security +
Footnote †: journal: _Applied_  
both regular and malicious network traffic from different network segments are included in the collection. The testing of intrusion detection systems is considered appropriate due to its realistic portrayal of network activities [11]. The intrusion detection system (IDS) model was developed by researchers using bagging, boosting, and random forest (RF) [12]. These techniques combine algorithms with decision-making mechanisms to increase the accuracy and robustness of the system. To reduce the dimensionality of the dataset and to improve detection efficacy, they employed feature selection [13]. Although the utility of ensemble approaches in IDS has been studied previously, it is still unknown whether or not these techniques can enhance IDS security. Ensemble models were shown to have improved accuracy, precision, recall, and F1-score in detecting unknown attacks [14]. According to the researchers, the feature selection enhanced the performance of the ensembled model. The selection qualities are necessary for intrusion detection to function. The results demonstrated that the significance of feature selection in IDS is that it outperforms single-algorithm models [15]. Additionally, a fog-based anomaly detection system created especially for IoT networks was introduced by the authors in [16]. By developing an anomaly detection system, the researchers were able to locate fog nodes [17]. This solution has the potential to decentralize an Internet of Things network with cloud architecture. The UNSW-NB15 dataset served as the foundation for the transformer model that was built for this investigation. The architecture of the model was created to identify unusual network activity in Internet of Things networks [18]. The model was trained using a variety of approaches, including supervised and unsupervised ones. Additionally, several metrics, including accuracy, precision, and recall, were used to evaluate the model's performance. Their research revealed that this approach was remarkably accurate in identifying anomalies. Furthermore, intrusion detection technologies can be hybrid, misuse-based, or anomaly-based [19; 20].