# A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data
## 3 Taxonomy of Anomaly Detection Techniques
### Anomaly Detection Techniques
#### 3.1.2 Deep Learning Techniques  
The use of deep learning in anomaly detection is one of the latest advancements in this field. To solve the problem of imbalanced classification for non-stationary time series, time-series anomaly detection for KPIs based on supervised deep learning models with neural convolution and long-short-term memory networks (LSTMs) and a vector auto-encoder (VAE) oversampling algorithm have been developed by researchers [PERSON] et al. [40]. To verify the performance of KPI-TSAD, Yahoo's benchmark anomaly detection datasets were used, and the detector performed well on the benchmark datasets. The proposed VAEGEN algorithm also produced better results than other common oversampling approaches. The primary drawback of this approach is that it required labelled data to train the model, which in most cases are not usable. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  
Another new anomaly detection algorithm based on neural network ensembles, called Streaming Autoencoder (SA), was developed by [PERSON] and [PERSON] [41] for evolving data streams. It is a one-class learner that only requires suitable instructional class data, which is reliable even without training. It features an autoencoder threaded ensemble with continuous learning capabilities. The results show anomalies with fewer false alarms are effectively identified by the new approach. One of the limitations of this technique, however, is scalability. The technique loses its capability when it comes to a large volume of data. In 2020, a neural network showed a promising improvement in the arena of anomaly detection. [PERSON] et al. [42], used a deep neural network to propose an algorithm named One sketch Fits All Time (OFAT) for addressing the issue of accurate long-range forecast within high-dimensional feature-evolving time series. The proposed algorithm is designed to address the issue generated by the non-stationary nature of feature-evolving time series causing the length of the input's sequence (rows) to change as new data points arrive with their feature values (columns) evolving over time. The experiments performed on real-world datasets and rigorous evaluation evidenced that OFAT has fast processing time, robust performance, and accurate detection. Yet, one of the limitations with this approach is that it does not consider real-time interactive forecasting in data streams. Similarly, for reliable anomaly detection in data streams, a real-time evolving spiking restricted Boltzmann machine technique named (e-SREBOM) was proposed by [PERSON] et al. [43]. It is a hybrid anti-malware detection technique that is sophisticated, revolutionary, and extremely efficient. It is a combination of the e-SNN and REBOM algorithms that allows the system to adjust to changes automatically. e-SREBOM can respond to high-complexity problems and provides a high degree of generalization. The proposed technique was evaluated on three-dimensional datasets with high complexity. However, the study made no attempt in considering the incremental online learning, with long-/short-term memory abilities, to ensure greater accuracy and efficiency. In 2020, [PERSON] et al. [44] proposed the Incremental Spatio-Temporal Learner (ISTL) to handle the issues and limitations of anomaly detection and localization for real-time video surveillance. ISTL is an unsupervised deep learning technique that uses active learning and fuzzy aggregation to constantly update and discriminate among new anomalies and normal data with respect to time. Three benchmark datasets are used to illustrate and test ISTL on precision, robustness, and computation complexity. The experiment findings confirm the efficiency of the proposed technique. However, one major drawback of this approach is that it fails to reduce false-negative detection, which effects the overall detection accuracy. In 2019, a real-time spiking restricted Boltzmann machines (e-SREBOM) approach was proposed [43]. It is a strategy of detecting malware that is hybrid, dynamic, innovative, and incredibly useful.