# A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data
## 4 Results  
Based on our review, there are still many open research challenges and issues to be resolved despite the development seen within the anomaly detection research. Furthermore, future directions are needed the most on anomaly detection approaches in the data stream. Therefore, the focus of this research will be limited to highlighting open challenges related to anomaly detection in the data stream, which is presented in Section 5.  
Since a massive volume of data comes in the form of data streams characterized by some problems, it is therefore necessary to address the challenging issue of detecting anomalies within evolving data streams efficiently. Most existing data stream algorithms for anomaly detection are losing their effectiveness in the existence of high-dimensional data. Therefore, it is necessary to redesign the current models to detect anomalies accurately and efficiently. More precisely, where there are many characteristics, there may be a set of anomalies that appear at a given time in only a subset of dimensions. This set of anomalies seems natural regarding a different sub-set to dimensions and/or time frame.  
Addressing the anomaly detection problem in a feature-evolving data stream is another primary concern. This challenge occurs when the data evolve over time, and the features of the data change. Furthermore, new/old data dimensions appear/disappear over time. It is a promising field with several possible use cases, such as detecting anomalies in IoT devices. Moreover, another challenge is handling and processing data in real-time when data points from the data source come constantly. Historically, data streams could be massive and should be handled in one pass. In addition, the algorithm should be able to process data in given memory, where enormous amounts of data should not influence the data stream's processing capabilities. Thus, the data stream algorithm should not require unlimited memory for the unlimited data points arriving in the system. Instead, it should be able to process the data within the available memory. Furthermore, the necessity for large-scale IoT implementation is increasing rapidly, with a significant security issue. Yet, a concern arises regarding anomaly detection scalability and how machine learning algorithms can handle large-scale sets. Scalability is a significant issue faced by most of the existing anomaly detection techniques, where some of these techniques lose their efficiency when it comes to large-scale deployment.  
Table 4 illustrates the summary of the reviewed anomaly detection techniques and their capability in meeting the criteria that describe a good quality anomaly detection technique. The reviewed techniques have been evaluated in their ability to perform data projection, handling noisy data, working within a limited memory and limited time. In addition, their ability to address evolving data, high-dimensional data, evolving features, and finally in scalability are addressed.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Techniques/Methods** & **Projection** & **Handling Noisy Data** & **Limited Time** & **Limited Memory** & **Handling Evolving Data** & **Handling High Dimensional Data** & **Evolving Features** & **Scalability** \\ \hline C\_LOF [14] & & & & \(\surd\) & & \(\surd\) & \(\surd\) \\ \hline AutoCloud [24] & & & & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) \\ \hline TEDA Clustering [25] & & & & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) \\ \hline Combination of (BDLMs) \& \(\surd\) & & & & & & \(\surd\) \\ (RBPF) [26] & \(\surd\) & & & & & & \(\surd\) \\ \hline HTM [27] & \(\surd\) & & \(\surd\) & & & & \\ \hline Artificial Neural Network [28] & & & & \(\surd\) & & & \(\surd\) \\ \hline MDADM [29] & & \(\surd\) & & \(\surd\) & \(\surd\) & & & \\ \hline Multi-kernel [30] & \(\surd\) & \(\surd\) & & & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) \\ \hline xStream [31] & \(\surd\) & & \(\surd\) & & & & \(\surd\) \\ \hline \hline \end{tabular}
\end{table}
Table 4: Anomaly detection techniques summary.