status

Draft

year

2026

type

Literature review

Abstract

This literature review examines the use of machine learning models for network anomaly detection and intrusion detection in Internet of Things environments. It begins from the security challenges created by the rapid growth of IoT systems, where connected devices are widely used in smart homes, healthcare, transportation, industrial automation, and other data-driven environments. Because many IoT devices have limited processing power, memory, and energy, they often cannot rely on strong built-in security mechanisms, which makes them vulnerable to attacks such as DDoS, malware, data breaches, and unauthorized access. The review studies recent approaches that use machine learning and deep learning to identify abnormal behavior in network traffic, including supervised models such as Decision Trees, Random Forest, K-Nearest Neighbors, and XGBoost, as well as hybrid CNN-RNN models and self-supervised learning methods based on autoencoders, contrastive learning, and transformers. The paper compares these approaches according to their methodology, strengths, limitations, and evaluation metrics, showing that models such as Random Forest and XGBoost can provide strong accuracy when supported by effective preprocessing and feature selection, while deep learning methods can capture more complex spatial and temporal traffic patterns. At the same time, the review highlights important limitations, including dependency on labeled datasets, dataset imbalance, high computational cost, training complexity, and difficulty deploying advanced models on resource-constrained IoT devices. The study concludes that future research should move toward lightweight, adaptive, and scalable detection models that can work efficiently in dynamic IoT environments while maintaining reliable detection performance.