A Systematic Literature Review of Artificial Intelligence-Based Anomaly Detection for Network Intrusion in IoT
DOI:
https://doi.org/10.51903/eqne0j35Keywords:
Artificial Intelligence, Internet of Things (IoT), Anomaly DetectionAbstract
The exponential growth of the Internet of Things (IoT) has created significant network security challenges, particularly in the face of network intrusions, where traditional detection methods often fail against adaptive attacks. This study presents a PRISMA-guided Systematic Literature Review (SLR) to understand the use of Artificial Intelligence (AI) in anomaly detection in IoT. The objectives are to identify dominant AI algorithms, evaluate their performance, and assess energy-efficiency considerations in recent research. The SLR analyzed 24 primary studies from the Scopus database published between 2021 and 2025. Key findings show the dominance of deep learning algorithms: Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and hybrid/ensemble models. These approaches have proven to be highly effective, with detection accuracy often exceeding 99% on benchmark datasets. In addition, resource efficiency was identified as a central issue. The solutions implemented included lightweight model optimization, Quantized Autoencoder (QAE) compression, and feature selection, which significantly reduced energy consumption and computational load. This research provides a comprehensive overview of state-of-the-art AI-based IoT anomaly detection, emphasizing the need to balance high accuracy and resource efficiency. As a result, future research should prioritize real-world testing, integrate Explainable AI (XAI), and develop standardized efficiency metrics for more practical and reliable IoT security solutions.
References
[1] S. A. Nugroho and F. R. Pratama, “Pengembangan Sistem Pendeteksi Kebocoran Gas LPG Berbasis Internet of Things di Putra Laundry Ungaran,” J. Ilm. Sist. Inf., vol. 4, no. 1, pp. 49–57, Jan. 2025, doi: 10.51903/2yzfj675.
[2] A. Nanjar, T. Safitri Maharani, P. A. Prastyo, M. Taufik, N. Hidayat, and I. Kharits, “Internet of Things (IoT) Integration in Telecommunication Networks: Challenges and Opportunities,” J. Technol. Informatics Eng., vol. 3, no. 1, pp. 11–24, Mar. 2024, doi: 10.51903/jtie.v3i1.156.
[3] B. W. Susilo and E. Susanto, “Employing Artificial Intelligence in Management Information Systems to Improve Business Efficiency,” J. Manag. Informatics, vol. 3, no. 2, pp. 212–229, Aug. 2024, doi: 10.51903/jmi.v3i2.30.
[4] N. J. Singh, N. Hoque, K. R. Singh, and D. K. Bhattacharyya, “Botnet-Based IoT Network Traffic Analysis Using Deep Learning,” Secur. Priv., vol. 7, no. 2, p. 355, Mar. 2024, doi: 10.1002/spy2.355.
[5] A. Nazir et al., “Advancing IoT Security: A Systematic Review of Machine Learning Approaches for the Detection of IoT Botnets,” J. King Saud Univ. - Comput. Inf. Sci., vol. 35, no. 10, p. 101820, Dec. 2023, doi: 10.1016/j.jksuci.2023.101820.
[6] M. Gelgi, Y. Guan, S. Arunachala, M. Samba Siva Rao, and N. Dragoni, “Systematic Literature Review of IoT Botnet DDOS Attacks and Evaluation of Detection Techniques,” Sensors, vol. 24, no. 11, p. 3571, Jun. 2024, doi: 10.3390/s24113571.
[7] E. Dritsas and M. Trigka, “A Survey on Cybersecurity in IoT,” Futur. Internet, vol. 17, no. 1, p. 30, Jan. 2025, doi: 10.3390/fi17010030.
[8] D. C. Muñoz and A. del C. Valiente, “A Novel Botnet Attack Detection for IoT Networks Based on Communication Graphs,” Cybersecurity, vol. 6, no. 1, pp. 33-, Dec. 2023, doi: 10.1186/s42400-023-00169-6.
[9] J. Arshad, M. A. Azad, R. Amad, K. Salah, M. Alazab, and R. Iqbal, “A Review of Performance, Energy and Privacy of Intrusion Detection Systems for IoT,” Electronics, vol. 9, no. 4, p. 629, Apr. 2020, doi: 10.3390/electronics9040629.
[10] A. Alfahaid, E. Alalwany, A. M. Almars, F. Alharbi, E. Atlam, and I. Mahgoub, “Machine Learning-Based Security Solutions for IoT Networks: A Comprehensive Survey,” Sensors, vol. 25, no. 11, p. 3341, May 2025, doi: 10.3390/s25113341.
[11] A. Villafranca, K. M. Thant, I. Tasic, and M.-D. Cano, “AI-Enabled IoT Intrusion Detection: Unified Conceptual Framework and Research Roadmap,” Mach. Learn. Knowl. Extr., vol. 7, no. 4, p. 115, Oct. 2025, doi: 10.3390/make7040115.
[12] M. Schmitt, “Securing the Digital World: Protecting Smart Infrastructures and Digital Industries With Artificial Intelligence (AI)-Enabled Malware and Intrusion Detection,” J. Ind. Inf. Integr., vol. 36, p. 100520, Dec. 2023, doi: 10.1016/j.jii.2023.100520.
[13] M. Fatima, O. Rehman, I. M. H. Rahman, A. Ajmal, and S. J. Park, “Towards Ensemble Feature Selection for Lightweight Intrusion Detection in Resource-Constrained IoT Devices,” Futur. Internet, vol. 16, no. 10, p. 368, Oct. 2024, doi: 10.3390/fi16100368.
[14] D. Pati and L. N. Lorusso, “How to Write a Systematic Review of the Literature,” Heal. Environ. Res. Des. J., vol. 11, no. 1, pp. 15–30, Jan. 2018, doi: 10.1177/1937586717747384.
[15] J. Jose and D. V. Jose, “AS-CL IDS: Anomaly and Signature-based CNN-LSTM Intrusion Detection System for Internet of Things,” Int. J. Adv. Technol. Eng. Explor., vol. 10, no. 109, pp. 1622–1639, 2023, doi: 10.19101/ijatee.2022.10100187.
[16] W. Khan et al., “Enhancing Security in 6G-Enabled Wireless Sensor Networks for Smart Cities: a Multi-Deep Learning Intrusion Detection Approach,” Front. Sustain. Cities, vol. 7, p. 1580006, May 2025, doi: 10.3389/frsc.2025.1580006.
[17] M. Tawfik, “Optimized Intrusion Detection in IoT and Fog Computing Using Ensemble Learning and Advanced Feature Selection,” PLoS One, vol. 19, no. 8, p. e0304082, Aug. 2024, doi: 10.1371/journal.pone.0304082.
[18] S. Sakraoui, A. Ahmim, M. Derdour, M. Ahmim, S. Namane, and I. Ben Dhaou, “FBMP-IDS: FL-Based Blockchain-Powered Lightweight MPC-Secured IDS for 6G Networks,” IEEE Access, vol. 12, pp. 105887–105905, 2024, doi: 10.1109/access.2024.3435920.
[19] S. Syed Sabir Mohamed, S. Gunasekaran, R. Chinnamuthu, and G. Singh, “Dynamic Hierarchical Intrusion Detection System for Internet of Vehicle on Edge Computing Platform,” IET Commun., vol. 18, no. 20, p. 1778, Dec. 2024, doi: 10.1049/cmu2.12865.
[20] O. P. Olawale and S. Ebadinezhad, “Cybersecurity Anomaly Detection: AI and Ethereum Blockchain for a Secure and Tamperproof IoHT Data Management,” IEEE Access, vol. 12, pp. 131605–131620, 2024, doi: 10.1109/access.2024.3460428.
[21] T. Alladi, V. Kohli, V. Chamola, and F. R. Yu, “A Deep Learning Based Misbehavior Classification Scheme for Intrusion Detection in Cooperative Intelligent Transportation Systems,” Digit. Commun. Networks, vol. 9, no. 5, pp. 1113–1122, Oct. 2023, doi: 10.1016/j.dcan.2022.06.018.
[22] H. Hatamleh, A. M. A. Alnaser, S. S. Saloum, A. Sharadqeh, and J. S. Alkasassbeh, “PictureGuard: Enhancing Software-Defined Networking–Internet of Things Security with Novel Image-Based Authentication and Artificial Intelligence-Powered Two-Stage Intrusion Detection,” Technologies, vol. 13, no. 2, p. 55, Feb. 2025, doi: 10.3390/technologies13020055.
[23] R. Khilar et al., “Artificial Intelligence-Based Security Protocols to Resist Attacks in Internet of Things,” Wirel. Commun. Mob. Comput., vol. 2022, no. 1, p. 1440538, Jan. 2022, doi: 10.1155/2022/1440538.
[24] K. C. Chaganti, “A Scalable, Lightweight AI-Driven Security Framework for IoT Ecosystems: Optimization and Game Theory Approaches,” IEEE Access, vol. 13, pp. 72235–72247, 2025, doi: 10.1109/access.2025.3558623.
[25] M. Keshk, N. Koroniotis, N. Pham, N. Moustafa, B. Turnbull, and A. Y. Zomaya, “An Explainable Deep Learning-Enabled Intrusion Detection Framework in IoT Networks,” Inf. Sci. (Ny)., vol. 639, p. 119000, Aug. 2023, doi: 10.1016/j.ins.2023.119000.
[26] M. Aidi Sharif and C. Author, “A Mechatronics System based on Feature Selection and AI for IoT Intrusion Detection Applications,” Int. J. Integr. Eng., vol. 14, no. 6, pp. 290–302, Nov. 2022, doi: 10.30880/ijie.2022.14.06.026.
[27] W. Villegas-Ch, J. Govea, R. Gutierrez, and A. Mera-Navarrete, “Optimizing Security in IoT Ecosystems Using Hybrid Artificial Intelligence and Blockchain Models: A Scalable and Efficient Approach for Threat Detection,” IEEE Access, vol. 13, pp. 16933–16958, 2025, doi: 10.1109/access.2025.3532800.
[28] L. Aversano, M. L. Bernardi, M. Cimitile, D. Montano, R. Pecori, and L. Veltri, “Explainable Anomaly Detection of Synthetic Medical IoT Traffic Using Machine Learning,” SN Comput. Sci. 2024 55, vol. 5, no. 5, pp. 488-, Apr. 2024, doi: 10.1007/s42979-024-02830-4.
[29] C. Park, J. Lee, Y. Kim, J. G. Park, H. Kim, and D. Hong, “An Enhanced AI-Based Network Intrusion Detection System Using Generative Adversarial Networks,” IEEE Internet Things J., vol. 10, no. 3, pp. 2330–2345, Feb. 2023, doi: 10.1109/jiot.2022.3211346.
[30] B. S. Sharmila and R. Nagapadma, “Quantized Autoencoder (QAE) Intrusion Detection System for Anomaly Detection in Resource-Constrained IoT Devices Using RT-IoT2022 Dataset,” Cybersecurity, vol. 6, no. 1, pp. 41-, Sep. 2023, doi: 10.1186/s42400-023-00178-5.
[31] S. Selvarajan et al., “An Artificial Intelligence Lightweight Blockchain Security Model for Security and Privacy in IIoT Systems,” J. Cloud Comput., vol. 12, no. 1, pp. 38-, Mar. 2023, doi: 10.1186/s13677-023-00412-y.
[32] N. Prazeres, R. L. de C. Costa, L. Santos, and C. Rabadão, “Engineering the Application of Machine Learning in an IDS Based on IoT Traffic Flow,” Intell. Syst. with Appl., vol. 17, p. 200189, Feb. 2023, doi: 10.1016/j.iswa.2023.200189.
[33] E. Tuyishime, M. Martalò, P. A. Cotfas, V. Popescu, D. T. Cotfas, and A. Rekeraho, “Resource-Efficient Traffic Classification Using Feature Selection for Message Queuing Telemetry Transport-Internet of Things Network-Based Security Attacks,” Appl. Sci., vol. 15, no. 8, p. 4252, Apr. 2025, doi: 10.3390/app15084252.
[34] J. Xie, “Application Study on the Reinforcement Learning Strategies in the Network Awareness Risk Perception and Prevention,” Int. J. Comput. Intell. Syst., vol. 17, no. 1, pp. 112-, May 2024, doi: 10.1007/s44196-024-00492-x.
[35] X. Fang et al., “Pioneering Advanced Security Solutions for Reinforcement Learning-Based Adaptive key Rotation in Zigbee Networks,” Sci. Rep., vol. 14, no. 1, pp. 13931-, Jun. 2024, doi: 10.1038/s41598-024-64895-8.
[36] S. Adilzhanova, M. Kunelbayev, G. Amirkhanova, Y. Zhussupov, and A. Tortay, “Development of a Data Collection and Storage System for Remote Monitoring and Detection of Security Threats in the Enterprise,” Int. J. Innov. Res. Sci. Stud., vol. 8, no. 2, pp. 176–196, Mar. 2025, doi: 10.53894/ijirss.v8i2.5136.
[37] J. G. Almaraz-Rivera, J. A. Perez-Diaz, J. A. Cantoral-Ceballos, J. F. Botero, and L. A. Trejo, “Toward the Protection of IoT Networks: Introducing the LATAM-DDoS-IoT Dataset,” IEEE Access, vol. 10, pp. 106909–106920, 2022, doi: 10.1109/access.2022.3211513.
[38] D. M. Ngo et al., “HH-NIDS: Heterogeneous Hardware-Based Network Intrusion Detection Framework for IoT Security,” Futur. Internet, vol. 15, no. 1, p. 9, Dec. 2022, doi: 10.3390/fi15010009.
Downloads
Published
Issue
Section
License
Copyright (c) 2025 Mirza Putra Firmansyah, Muhammad Naufal Nashir, Nazli Rahmeisi, Putri Safira Augusta, Arief Arfriandi
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
All articles published in this journal are open access and licensed under the terms of the Creative Commons Attribution-ShareAlike 4.0 International License (CC BY-SA 4.0).
Under this license:
-
Authors retain copyright of their work.
-
Others are free to:
-
Share — copy and redistribute the material in any medium or format;
-
Adapt — remix, transform, and build upon the material for any purpose, even commercially;
-
-
As long as they:
-
Give appropriate credit to the original author(s) and the source;
-
Provide a link to the license;
-
Indicate if changes were made;
-
Distribute their contributions under the same license as the original.
-
This ensures that derivative works will also remain free and open under the same terms.
.png)
