**2. IoT value chain**

The IoT value chain in **Figure 1** shows that the value added services to IoT & key differentiator is the data analytics part which comprises the anomaly detection component with the help of TSA. Data analytics in IoT could be a higher income generator than key technology enablers like SDN, IPv6, and 5G, even more than machine automation. We are talking about Analytics as a Service (AaaS). According to Cisco's annual Visual Networking Index, machineto-machine (M2M) connections that support IoT applications will account for more than half of the world's 27.1 billion devices and connections by 2021.

### **2.1. Anomalies categories**

**Table 1** illustrates the anomalies descriptions in selected smart cities IoT use cases.

Let us now classify the anomalies in the time domain.

**i.** *Static vs. dynamic*: anomalies are defined as data points not following current patterns; static means in the same direction but with different characteristics whereas dynamic refers to opposite direction.


**Table 1.** Benefits of Anomaly Detection in Smart City Applications.

Introductory Chapter: Time Series Analysis (TSA) for Anomaly Detection in IoT http://dx.doi.org/10.5772/intechopen.72669 3

**Figure 2.** Outlier anomaly (https://anomaly.io/anomaly-detection-normal-distribution/).


#### **2.2. Time series models**

gateways and routers to accommodate devices connection, routing, and IoT data transit. The myriad of technologies involved within the IoT ecosystem should empower smart environments as it happens likewise in smart cities. The next section introduces the IoT value chain and then lists some use cases of IoT in smart environments whereby anomalies arouse, followed by the classification of anomalies in the time domain, the time series models applicable

The IoT value chain in **Figure 1** shows that the value added services to IoT & key differentiator is the data analytics part which comprises the anomaly detection component with the help of TSA. Data analytics in IoT could be a higher income generator than key technology enablers like SDN, IPv6, and 5G, even more than machine automation. We are talking about Analytics as a Service (AaaS). According to Cisco's annual Visual Networking Index, machineto-machine (M2M) connections that support IoT applications will account for more than half

**Table 1** illustrates the anomalies descriptions in selected smart cities IoT use cases.

**i.** *Static vs. dynamic*: anomalies are defined as data points not following current patterns; static means in the same direction but with different characteristics whereas dynamic

and finally problematics in applying TSA to anomaly detection in IoT.

of the world's 27.1 billion devices and connections by 2021.

Let us now classify the anomalies in the time domain.

**Table 1.** Benefits of Anomaly Detection in Smart City Applications.

**Smart** *Anomalies description Benefits*

Water Water leakages To prevent water waste

Building Electricity peak and pipe leakage Energy monitoring Farm Anomalies in farm data and weather Monitor growth

Goods Traffic congestion spots Optimize route and delivery

Lighting Broken bulbs Save time and fuel for maintenance Home Gas leakage Alert home users on the incident

**2. IoT value chain**

**Figure 1.** IoT Value Chain.

2 Time Series Analysis and Applications

**2.1. Anomalies categories**

refers to opposite direction.

There is actually no one size fit all solution for the development of an ADE as well as no de facto time series model that suits the ADE. Below are some of the popular time series models adopted for ADE in IoT.


**iv.** *Machine learning*: there are two main branches of machine learning namely supervised learning whereby the pattern for the anomaly is learnt and known, whereas in supervised mode, detection is done by inference or featuring. The latter is more challenging as the anomaly pattern is unknown and the algorithm learnt from the data points is to be analyzed. The supervised mode comprises the following methods: Decision Table, Random Forest, K-nearest Neighbor, SVMs, Deep Learning, Naive Bayes. The popular "*unsupervised*" algorithms are K-means clustering, DBSCAN, N-SVM, Stream Clustering, and LDA (Latent Dirichlet Allocation).

### **2.3. Problematics**

Below listed are the 10 main issues, in which some are inherent to the IoT network and others to the time series properties.


**x.** Non-linearity: date points that are not stationary and changing with time would require multivariate analysis.
