# A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data
## 3 Taxonomy of Anomaly Detection Techniques
### Evaluation Criteria  
To measure the performance of anomaly detection techniques, the \"accuracy\" metric was used in [27; 28; 29]. Nevertheless, in the event of imbalanced datasets, the reported accuracy will not offer an accurate representation of the technique's efficiency. To measure the performance more accurately, metrics such as True Positive (TP), True Negative (TN), False Positive (FP), False Negative (FN), precision, recall, and F1 scores are used [34; 35; 36; 37]. TP offers the information regarding how many positive cases are accurately detected. TN provides the information regarding how many negative cases are accurately labeled as negative cases. FP gives the information regarding the false labeled cases as a positive case. Similarly, FN offers the information regarding the cases that are positive but falsely labeled as negative. Precision is known as the number of class members classified accurately over the total number of cases classified as class members [14]. Recall is known as the number of class members classified correctly over the total number of class members [32]. In anomaly detection, high precision and high recall are needed to develop a high-quality technique. In such scenarios, F-measure is applied to provide an equal importance to precision and recall. Recently, receiving operating characteristics, such as Area Under the Curve (AUC), have also gained popularity in measuring the anomaly detection technique's performance [39]. AUC is the two-dimensional area underneath the curve and interpreted as a probability, which the model ranks a random positive example more highly than a random negative  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Window Model** & **Definition** & **Pros** & **Cons** \\ \hline \multirow{4}{*}{\begin{tabular}{c} Fading (damped) window \\ model \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} Assigning weights to data \\ points \\ \end{tabular} } & \begin{tabular}{c} Compatible for applications in \\ which old data has a significant \\ effect on the mining results, the \\ effect decreases (faded) with \\ respect to time \\ \end{tabular} & \begin{tabular}{c} Infinite time window (the \\ window collects the entire \\ history of the data, the size of \\ the window continues to \\ expand as time passes) \\ \end{tabular} \\ \hline \multirow{4}{*}{\begin{tabular}{c} Landmark window model \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} Analyzing the complete \\ data stream history \\ \end{tabular} } & \begin{tabular}{c} Compatible for one-pass \\ clustering algorithms \\ \end{tabular} & \begin{tabular}{c} The entire data are equally \\ relevant and the volume of data \\ within the window will rapidly \\ increase to un-processable sizes. \\ \end{tabular} \\ \hline \multirow{4}{*}{\begin{tabular}{c} Sliding window model \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} Analyzing the very latest \\ data points \\ \end{tabular} } & \
\begin{tabular}{c} Compatible for applications in \\ which the interest exists only in \\ the very latest data such as \\ stock-marketing \\ \end{tabular} & \multirow{4}{*}{
\begin{tabular}{c} Disregards part of streams \\ \end{tabular} } \\ \hline \hline \end{tabular}
\end{table}
Table 3: Window models in clustering data streams.  
example. It offers robust evaluation in comparison with accuracy in cases of imbalanced datasets, usually utilized with machine learning and deep learning techniques.