{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T19:56:00Z","timestamp":1775850960856,"version":"3.50.1"},"reference-count":37,"publisher":"SAGE Publications","issue":"10","license":[{"start":{"date-parts":[[2022,10,1]],"date-time":"2022-10-01T00:00:00Z","timestamp":1664582400000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61932011"],"award-info":[{"award-number":["61932011"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61972019"],"award-info":[{"award-number":["61972019"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"national key research and development program of china","doi-asserted-by":"publisher","award":["2020YFB1005600"],"award-info":[{"award-number":["2020YFB1005600"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["International Journal of Distributed Sensor Networks"],"published-print":{"date-parts":[[2022,10]]},"abstract":"<jats:p>With the popularization of Internet of things, its network security has aroused widespread concern. Anomaly detection is one of the important technologies to protect network security. To meet the needs of automatic and intelligent detection, supervised machine learning is widely used in anomaly detection. However, the existing schemes ignore the problem of data quality, which leads to the unsatisfactory detection effect in practice. Therefore, practitioners may not know which algorithm to choose due to the lack of review and evaluation of anomaly detection methods under low-quality data. To address this problem, we give a detailed review and evaluation of six supervised anomaly detection methods, as well as release the core code of feature extractor for pcap format traffic traces and anomaly detection methods for reuse. We evaluate the methods on two public datasets (one is a simulated network dataset and the other is a real Internet of things dataset). We believe that our work and insights will help practitioners quickly understand and develop anomaly detection schemes for Internet of things and can provide reference for future research.<\/jats:p>","DOI":"10.1177\/15501329221133765","type":"journal-article","created":{"date-parts":[[2022,10,29]],"date-time":"2022-10-29T06:16:55Z","timestamp":1667024215000},"page":"155013292211337","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":15,"title":["Machine learning for Internet of things anomaly detection under low-quality data"],"prefix":"10.1177","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1976-7856","authenticated-orcid":false,"given":"Shangbin","family":"Han","sequence":"first","affiliation":[{"name":"School of Cyber Science and Technology, Beihang University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qianhong","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Beihang University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yang","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Beihang University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2022,10,28]]},"reference":[{"key":"bibr1-15501329221133765","doi-asserted-by":"publisher","DOI":"10.23919\/JCC.2022.08.015"},{"key":"bibr2-15501329221133765","first-page":"305","volume-title":"Proceedings of the 2019 IEEE 9th annual computing and communication workshop and conference (CCWC)","author":"Alrashdi I"},{"key":"bibr3-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1051\/matecconf\/201815901053"},{"key":"bibr4-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2019.100059"},{"key":"bibr5-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1109\/InfoTech.2019.8860878"},{"key":"bibr6-15501329221133765","doi-asserted-by":"publisher","DOI":"10.11591\/eei.v8i1.1387"},{"key":"bibr7-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1109\/IoT52625.2021.9469605"},{"issue":"1","key":"bibr8-15501329221133765","first-page":"63","volume":"7","author":"Davahli A","year":"2020","journal-title":"J Comput Secur"},{"key":"bibr9-15501329221133765","doi-asserted-by":"publisher","DOI":"10.3390\/fi12030044"},{"key":"bibr10-15501329221133765","first-page":"100156","volume":"6","author":"Onah JO","year":"2021","journal-title":"Mach Learn Appl"},{"issue":"7","key":"bibr11-15501329221133765","doi-asserted-by":"crossref","first-page":"e4121","DOI":"10.1002\/ett.4121","volume":"32","author":"Reddy DK","year":"2021","journal-title":"Trans Emerg Telecommun Technol"},{"key":"bibr12-15501329221133765","unstructured":"Jacobson V, Leres C, MeCanne S. Tcpdump: a network monitoring and packet capturing tool, 2001, www.tcpdump.org"},{"key":"bibr13-15501329221133765","volume-title":"Wireshark network analysis: the official Wireshark certified network analyst study guide","author":"Chappell L","year":"2010"},{"key":"bibr14-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1109\/CSNET.2017.8241999"},{"key":"bibr15-15501329221133765","doi-asserted-by":"crossref","unstructured":"Mirsky Y, Doitshman T, Elovici Y, et al. Kitsune: an ensemble of autoencoders for online network intrusion detection, 2018, https:\/\/arxiv.org\/abs\/1802.09089","DOI":"10.14722\/ndss.2018.23204"},{"key":"bibr16-15501329221133765","first-page":"1","volume-title":"Proceedings of the 12th international conference on availability, reliability and security","author":"Hodo E","year":"2017"},{"key":"bibr17-15501329221133765","doi-asserted-by":"publisher","DOI":"10.5220\/0009345300780087"},{"key":"bibr18-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2020.2966951"},{"key":"bibr19-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2930717"},{"key":"bibr20-15501329221133765","unstructured":"Hans J. FlowFeatureExtract, https:\/\/github.com\/JasonHans\/FlowFeatureExtract.git (2022, accessed 25 May 2022)."},{"key":"bibr21-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2020.106229"},{"key":"bibr22-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1007\/s11053-019-09512-6"},{"key":"bibr23-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1109\/ICBEIA.2011.5994250"},{"key":"bibr24-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1016\/j.bpa.2005.07.009"},{"key":"bibr25-15501329221133765","doi-asserted-by":"crossref","unstructured":"Lai YC, Zhou KZ, Lin SR, et al. Flow-based anomaly detection using multilayer perceptron in software defined networks. In: Proceedings of the 2019 42nd international convention on information and communication technology, electronics and microelectronics (MIPRO), Opatija, 20\u201324 May2019, pp.1154\u20131158. New York: IEEE.","DOI":"10.23919\/MIPRO.2019.8757199"},{"key":"bibr26-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1109\/ICSCEE.2018.8538395"},{"key":"bibr27-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1051\/itmconf\/20203203003"},{"key":"bibr28-15501329221133765","unstructured":"Hettich S, Bay SD. The UCI KDD Archive, http:\/\/kdd.ics.uci.edu (1999, accessed 25 May 2022)."},{"key":"bibr29-15501329221133765","first-page":"2825","volume":"12","author":"Pedregosa F","year":"2011","journal-title":"J Mach Learn Res"},{"key":"bibr30-15501329221133765","unstructured":"Hans J. MultiClassesAnomalyDetection, https:\/\/github.com\/JasonHans\/MultiClassesAnomalyDetection.git (2022, accessed 25 May 2022)."},{"key":"bibr31-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2019.102460"},{"key":"bibr32-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1109\/ICRIS.2017.61"},{"key":"bibr33-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102215"},{"key":"bibr34-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1016\/j.proeng.2012.01.849"},{"key":"bibr35-15501329221133765","doi-asserted-by":"publisher","DOI":"10.3233\/JIFS-191448"},{"key":"bibr36-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1145\/1163593.1163596"},{"key":"bibr37-15501329221133765","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098163"}],"container-title":["International Journal of Distributed Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/15501329221133765","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/15501329221133765","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/15501329221133765","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,29]],"date-time":"2023-11-29T19:20:01Z","timestamp":1701285601000},"score":1,"resource":{"primary":{"URL":"http:\/\/journals.sagepub.com\/doi\/10.1177\/15501329221133765"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10]]},"references-count":37,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2022,10]]}},"alternative-id":["10.1177\/15501329221133765"],"URL":"https:\/\/doi.org\/10.1177\/15501329221133765","relation":{},"ISSN":["1550-1329","1550-1477"],"issn-type":[{"value":"1550-1329","type":"print"},{"value":"1550-1477","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,10]]}}}