# A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data
## 3 Taxonomy of Anomaly Detection Techniques
### Anomaly Detection Techniques
#### 3.1.1 Machine Learning Techniques
A full online method, called CEDAS, has been introduced for clusters evolving data streams into arbitrary-shaped clusters [36]. It is a two-stage solution that is effective, noise-resistant, and productive in memory and computing use, with low latency as the number of data dimensions. The results revealed the proposed algorithm's ability to deal with changing data sources entirely online. The proposed algorithm compares velocity, purity of the cluster, precision, and memory capacity favorably with similar techniques. However, this technique does not consider the evolution of the feature and the high dimensionality of the data. On the other hand, a new method called MuDi-Stream [37] consisted of four main components of the online-offline phases. The online phase maintains summary information on the evolving multi-density data stream into core mini clusters. In contrast, to generate final clusters, the offline phase uses an adapted density-based clustering algorithm. An anomaly buffer for handling both noise and multi-density information is the grid-based approach. The algorithm is evaluated on different synthetic and real-world datasets using different quality metrics, and results on scalability are presented. The experimental results show that the approach proposed in this study increases the effectiveness of clustering in multi-density environments. However, the main weakness of this method is that as the number of empty grids increases, it cannot handle high-dimensional data and thus makes the processing time slower. Fast anomaly detection algorithms were suggested using Extreme Learning Machine (ELM) [38], to discover operationally significant anomalies. The method is used over large aviation datasets to address elevated computational training time. The authors carried out the experiments on a real benchmark aviation safety dataset in an unsupervised fashion, including 43,000 flight data on radar information, flight trajectories, and distance from nearby aircraft. Nevertheless, the authors did not use the benchmarked data to demonstrate the performance of the proposed method and compare its performance with the state-of-the-art techniques. [PERSON] et al. [39] proposed a novel dynamic anomaly detection framework on time-evolving attributed networks called (AMAD). AMAD utilized the advantage of the evolving characteristics of the underlying attributed networks and models. Precisely, AMAD progressively updates the detection results by measuring the difference in residuals among the two consecutive timestamps and applying it to the previous residuals. To prevent the negative effects of unwanted and noisy features, the proposed method performs attribute selection while processing the residuals for anomaly detection. Tests performed on both synthetic and real-world datasets show that the proposed method is effective and efficient. Nevertheless, the study fails to handle the high dimensionality of the data and ignore its effect towards the power and memory consumption of the framework. Table 1 presents a summary of the machine learning techniques used for anomaly detection in data streams. The table highlights the nature of data used for executing the experiments, the types of anomalies found within the data, the windowing model applied, the dataset used, and finally the criteria used for evaluating the proposed techniques.