# Anomaly Detection for IOT Systems Using Active Learning
###### Abstract
The misuse-based approach builds signatures utilizing expert skills and domain knowledge. Then, it looks for a network data pattern matching one or more database signatures. The misuse-based approach has a low false-positive rate since it can identify intrusions that fit a database signature [21]. Suppose it cannot recognize unknown intrusions that may not include any database patterns, especially if the attacker knows the database contains signatures. In that case, it may have a high false-negative rate. The misuse-based IDS must update database signatures and rules often to fix it. However, the anomaly-based strategy first learns normal network behaviors and then finds anomalies that deviate from them [21]. The anomaly-based technique can detect new assaults [22]. Likewise, the machine teaches most network behaviors, with no explicit rules. If IDS rules are supplied, attackers are less likely to learn them and make their attacks invisible [23]. As any previously unforeseen activity can be considered an anomaly, however, the anomaly-based strategy can create many false alarms. In a scholarly publication, the author [24] reported a study that demonstrated the application of a supervised machine learning (ML) approach for an IDS in the IoT domain. These authors utilized the application and transport layer features of the UNSW-NB15 dataset. The technique being suggested involved the categorization of network traffic into two distinct groups: dangerous and benign. This categorization is achieved through the utilization of a decision tree (DT) classifier. To assess the efficacy of the proposed methodology, a 10-fold cross-validation approach was employed. The findings indicated that the suggested methodology achieved a 98.58% level of accuracy. The machine learning subfield, active learning, emphasizes learning from a few training examples [25]. Since IDS labels take time, it is ideal for IDS design, but may be difficult to label invasions that have never occurred before. Active learning combines machine learning and domain experts. It can reduce labeling efforts and quickly develop a machine learning model for intrusion detection. Accordingly, the active learning architecture can quickly update the machine learning model for new network assaults [26; 27; 28; 29]. The diagram in Figure 1 illustrates a comprehensive framework utilized for anomaly detection in Internet of Things (IoT) systems, employing the active learning technique. The framework encompasses a series of fundamental stages, commencing with the first dataset phase, wherein the widely used UNSW-NB15 Network Intrusion Dataset is utilized. The initial data preparation phase includes crucial procedures such as data cleansing, selecting relevant features, normalizing features, and partitioning data into training and testing sets. The methodology section presents an architectural framework for a smart city based on the IoT, emphasizing the interconnection of nodes through smart traffic, buildings, and grids. The paper presents the technique for the active learning algorithm and the evaluation matrix used to assess its effectiveness. The evaluation matrix includes accuracy, precision, F1-score, a confusion matrix, and ROC curve. Ultimately, the final step of the process involves determining whether or not an anomaly has been found. Moreover, the study presented in this paper makes several significant contributions:  
* It proposes an active learning technique that is specifically tailored for anomaly detection. This technique considers the unique characteristics of anomaly detection and aims to improve the performance of anomaly detection models. * Our model is evaluated on the UNSW-NB15 dataset, a publicly available dataset containing accurate network traffic data from an IoT device. * It introduces a novel sampling strategy that is based on the concept of uncertainty. This strategy aims to select the most informative instances for labeling, thereby enhancing the learning process.