# A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data
## 5 Research Challenges and Future Directions  
Even though various anomaly detection techniques have been proposed in the literature, there are still several issues to be solved for anomaly detection. Currently, there is no single best technique for the problem; rather, there are several techniques that may be more applicable to certain data types and certain application domains. Below we present a summary of the major challenges found within the state-of-the-art techniques reviewed:  
1. Evolving Data Stream  
As a vast volume of knowledge falls in the form of data streams labeled by such anomalies, efficiently overcoming the challenging task of detecting anomalies in evolving data streams is necessary [25]. Data streams pose external detection problems, such as detecting in restricted memory and limited time, updating the data once they enter, and managing data in a changing fashion to capture the fundamental changes when detecting them [29]. Data evolution includes algorithms to adjust their configuration and parameters over time and as new knowledge arises. Detection algorithms fail to adjust to complex conditions, such as the ever-changing IoT domain, unlike static records [64]. Further, most existing are less efficient in detecting anomalies in data stream and have poor capability requirements [15]. Detecting anomalies in the IoT data stream environment, known for its evolving characteristics, results in low detection accuracy with a high false-positive rate [43]. The evolving data stream is a challenge that must be addressed in the environment of IoT anomaly detection [24; 65]. 2. Feature-Evolving  
In a feature-evolving data source, another difficulty would be solving the issue of anomaly detection. The concern is that the data change, and the properties of the data also shift. In comparison, over time, new/old dimensions of data appear/disappear. This area is fascinating, with many potential applications, such as outlier detection in IoT systems in which the sensors periodically go off/on (representing the number of dimensions) [31]. 3. Windowing  
The precision is limited (windowing) because of the short data processing used based on fixed interval timing [66]. Another major challenge is determining which frequency is \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Techniques/Methods** & **Projection** & \begin{tabular}{c} **Handling** \\ **Noisy Data** \\ \end{tabular} & \begin{tabular}{c} **Limited** \\ **Time** \\ \end{tabular} & \begin{tabular}{c} **Limited** \\ **Memory** \\ \end{tabular} & \begin{tabular}{c} **Handling** \\ **Devolving** \\ **Data** \\ \end{tabular} & \
\begin{tabular}{c} **Handling High** \\ **Dimensional Data** \\ \end{tabular} &
\begin{tabular}{c} **Evolving** \\ **Features** \\ \end{tabular} & **Scalability** \\ \hline Regression Model [32] & & & \(\surd\) & & & & & & \\ \hline Super Vector Machine [33] & & \(\surd\) & & \(\surd\) & & & & \(\surd\) \\ \hline HTM [54] & \(\surd\) & \(\surd\) & & \(\surd\) & \(\surd\) & \(\surd\) & & \\ \hline CEDAS [36] & & \(\surd\) & & \(\surd\) & & & & \\ \hline HTM [35] & & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & & & \\ \hline MuDi-Stream [37] & & & & \(\surd\) & & \(\surd\) & & \\ \hline Extreme Learning Machines [38] & \(\surd\) & \(\surd\) & & \(\surd\) & \(\surd\) & \(\surd\) & & \(\surd\) \\ \hline AMAD [39] & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & & \(\surd\) \\ \hline LSTMs [40] & & \(\surd\) & & \(\surd\) & & & & \\ \hline Autoencoder [41] & & \(\surd\) & & & \(\surd\) & & & \(\surd\) \\ \hline (GAT) Deep neural & & & & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) \\ network [42] & & \(\surd\) & & & \(\surd\) & \(\surd\) & \(\surd\) \\ \hline Evolving spiking neural & & & & & \(\surd\) & & & \\ network [43] & & & & & \(\surd\) & & & \\ \hline ISTL [44] & & & \(\surd\) & \(\surd\) & \(\surd\) & & & \\ \hline (e-SREBOM) [43] & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & & & \(\surd\) \\ \hline \hline \end{tabular}
\end{table}