# A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data
## 3 Taxonomy of Anomaly Detection Techniques
### Anomaly Detection Learning Modes
#### 3.4.3 Unsupervised Anomaly Detection  
Unsupervised anomaly detection is emphasized by unlabeled information, which does not require separate training and testing stages. Clustering-based detection of anomalies is a general example [18]. The unsupervised anomaly detection approach is grouped into one category, namely clustering, as shown below.  
Clustering  
The objective of using clustering algorithms is to identify the normal data in the input. The input space has a structure such that certain patterns occur more frequently than others, and we want to see what usually happens and what does not happen. In statistics, this step is called estimating the density. Clustering is one method for estimating the density. For example, utilizing coupling-edge data analysis and cloud data analysis automatically detects anomalies in heterogeneous sensor networks.  
In an intelligent transportation system, [PERSON] and [PERSON] [53] built a stacked denoising autoencoder model to detect anomalies in a gas turbine engine. Furthermore, PNN was evaluated in the industrial system over a real-time thermal power system dataset to explore the anomalies [54]. In smart cities, neural network algorithms have been utilized [55] to detect attacks on IoT architecture. Similarly, neural networks were used by [PERSON] et al. [56] to detect outliers in the smart home large-scale dataset.  
One of the most frequently used unsupervised machine-learning algorithms is K-means clustering. [PERSON] and [PERSON] [38] used K-means clustering to design a detection and firewall method for anomalies for the IoT site microservices in smart cities.  
A gaussian mixture model (GMM) is a probability method that has the assumption that the entire data points are produced from a mixture of a finite number of unknown parameter Gaussian distributions. The K-means clustering companied with GMM has been used in road transport by [PERSON] et al. [57] to propose a visual analytics framework for road traffic anomaly detection.  
The healthcare system [58] used HMM to design a non-intrusive sleep analyzer for detecting real-time sleep anomalies. In the industrial system, [PERSON] et al. [59] proposed a special feature-extraction method for detecting anomalies within time series based on the transfer probability of a Markov chain.  
Furthermore, [PERSON] et al. [60] used clustering for monitoring the energy consumption of indoor office devices. In intelligent transportation, a structured sparse subspace clustering was used by [PERSON] et al. [61] and proposed to detect anomalies. Similarly, [PERSON] et al. [62] designed an ANOVA-based technique to detect a vehicle's anomalous behavior.  
Clustering has also been used in database management system as predictive modelling and anomaly detection. In such domain application, an incremental equivalence class transformation (i-Eclat) algorithm has been proposed to serves as the association rule mining database engine in testing frequent itemset mining (FIMI) datasets from online repository [10].