Edge-Enabled Anomaly Detection for Internet of Things Networks: Architectures, Learning Methods, and Security Considerations

Abstract

The proliferation of Internet of Things devices has produced distributed environments characterized by continuous data generation, heterogeneous hardware, constrained computational resources, and expanded cybersecurity attack surfaces. Traditional cloud-centric security architectures may introduce latency, bandwidth consumption, and dependence on remote connectivity that limit their effectiveness for time-sensitive anomaly detection. Edge and fog computing offer an alternative by positioning computation, storage, and security analytics closer to data-generating devices. This review examines edge-enabled anomaly and intrusion detection approaches applicable to IoT environments through 2020. It first discusses cloud, fog, and edge architectures and analyzes their implications for latency, scalability, security monitoring, and computational resource allocation. Classical statistical and machine-learning approaches are then compared with emerging deep-learning techniques including autoencoders, recurrent neural networks, and ensemble-based detection. Representative IoT intrusion-detection systems and datasets, including SVELTE, UNSW-NB15, N-BaIoT, Bot-IoT, and Kitsune, are considered in relation to traffic characteristics and deployment requirements. The review identifies persistent challenges involving highly imbalanced network traffic, concept drift, adversarial behavior, resource-constrained devices, encrypted communication, false-positive rates, and limited availability of realistic benchmark datasets. Edge intelligence is concluded to be a promising architectural foundation for responsive IoT security, provided that detection accuracy is balanced against resource and privacy constraints.