# A Multi-Step Comparative Framework for Anomaly Detection in IoT Data Streams

arXiv: https://arxiv.org/abs/2505.16872 · HTML: https://mlsanity.com/paper/2505.16872/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 2 of its 16 references that are in the map.
- First posted on arXiv 22 May 2025.

## Builds on (most cited first, 2 of 2)

- [PWPAE: An Ensemble Framework for Concept Drift Adaptation in IoT Data Streams](https://mlsanity.com/paper/2109.05013/) (2021)
- [A Multi-Stage Automated Online Network Data Stream Analytics Framework for IIoT Systems](https://mlsanity.com/paper/2210.01985/) (2022)

## Abstract (arXiv)

The rapid expansion of Internet of Things (IoT) devices has introduced critical security challenges, underscoring the need for accurate anomaly detection. Although numerous studies have proposed machine learning (ML) methods for this purpose, limited research systematically examines how different preprocessing steps--normalization, transformation, and feature selection--interact with distinct model architectures. To address this gap, this paper presents a multi-step evaluation framework assessing the combined impact of preprocessing choices on three ML algorithms: RNN-LSTM, autoencoder neural networks (ANN), and Gradient Boosting (GBoosting). Experiments on the IoTID20 dataset shows that GBoosting consistently delivers superior accuracy across preprocessing configurations, while RNN-LSTM shows notable gains with z-score normalization and autoencoders excel in recall, making them well-suited for unsupervised scenarios. By offering a structured analysis of preprocessing decisions and their interplay with various ML techniques, the proposed framework provides actionable guidance to enhance anomaly detection performance in IoT environments.