Machine Learning for Anomaly Detection: A Systematic Review
Open accessAbstract
Anomaly detection has been used for decades to identify and extract anomalous components from data. Many techniques have been used to detect anomalies. One of the increasingly significant techniques is Machine Learning (ML), which plays an important role in this area. In this research paper, we conduct a Systematic Literature Review (SLR) which analyzes ML models that detect anomalies in their application. Our review analyzes the models from four perspectives; the applications of anomaly detection, ML techniques, performance metrics for ML models, and the classification of anomaly detection. In our review, we have identified 290 research articles, written from 2000-2020, that discuss ML techniques for anomaly detection. After analyzing the selected research articles, we present 43 different applications of anomaly detection found in the selected research articles. Moreover, we identify 29 distinct ML models used in the identification of anomalies. Finally, we present 22 different datasets that are applied in experiments on anomaly detection, as well as many other general datasets. In addition, we observe that unsupervised anomaly detection has been adopted by researchers more than other classification anomaly detection systems. Detection of anomalies using ML models is a promising area of research, and there are a lot of ML models that have been implemented by researchers. Therefore, we provide researchers with recommendations and guidelines based on this review.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Cloud-based architectures have been used for many anomaly detection applications [131].
“Cloud-based architectures have been used for many anomaly detection application [131].”
From A Comprehensive Survey on TinyML (2023) · cites this paper as [131]
Anomaly detection techniques are used in a variety of IoT smart applications [131] such as smart city, smart monitoring and smart power management.
“This techniques are used in variety of IoT smart applications [131] such as, smart city, smart monitoring and smart power management.”
From A Comprehensive Survey on TinyML (2023) · cites this paper as [131]
These devices generated a huge volume of data that are transmitted to cloud servers for analysis, decision making and storage [131].
“These devices generated a huge volume of data that are transmitted to the cloud servers for analysis, decision making and storage [131].”
From A Comprehensive Survey on TinyML (2023) · cites this paper as [131]
Cites
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332 · see citing works
Enhanced Network Anomaly Detection Based on Deep Neural Networks
Naseer, S., Saleem, Y., Khalid, S., Bashir, M. K., Han, J., Iqbal, M. M., & Han, K. (2018) · IEEE Access · doi:10.1109/access.2018.2863036 · Cited by 507 · see citing works
Semi-Supervised Anomaly Detection for EEG Waveforms Using Deep Belief Nets
Wulsin, D., Blanco, J., Mani, R., & Litt, B. (2010) · 2010 Ninth International Conference on Machine Learning and Applications · doi:10.1109/icmla.2010.71 · Cited by 98 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A Comprehensive Survey on TinyML
Abadade, Y., Temouden, A., Bamoumen, H., Benamar, N., Chtouki, Y., & Hafid, A. S. (2023) · IEEE Access · doi:10.1109/access.2023.3294111 · Cited by 366 · see citing works
“popular as a way to identify abnormal situations [131].”
BackgroundOn the Quest for Effectiveness in Human Oversight: Interdisciplinary Perspectives
Sterz, S., Baum, K., Biewer, S., Hermanns, H., Lauber-Rönsberg, A., Meinel, P., & Langer, M. (2024) · The 2024 ACM Conference on Fairness Accountability and Transparency · doi:10.1145/3630106.3659051 · Cited by 91 · see citing works
“This discussion could also include aspects such as stakes of the situation [47], single vs. multitasking environments [52], or whether oversight is organized as a team task [28, 84].”
BackgroundADT: Time series anomaly detection for cyber-physical systems via deep reinforcement learning
Yang, X., Howley, E., & Schukat, M. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103825 · Cited by 47 · see citing works
One-Class Anomaly Detection for Industrial Applications: A Comparative Survey and Experimental Study
Paolini, D., Dini, P., Soldaini, E., & Saponara, S. (2025) · Computers · doi:10.3390/computers14070281 · Cited by 21 · see citing works
Anomaly Detection in Spacecraft Telemetry Using Vision Transformer and Caps-LSTM
Rajesh, S., Jarin, T., Emin Thomas, C., & Jaison, J. (2025) · 2025 Advanced Computing and Communication Technologies for High Performance Applications (ACCTHPA) · doi:10.1109/accthpa65749.2025.11168608
- Authors
- Nassif, A. B., Talib, M. A., Nasir, Q., & Dakalbab, F. M.
- Affiliations
- University of Sharjah (AE)
- Venue
- IEEE Access
- Published
- 2021
- Volume
- 9
- Pages
- 78658-78700
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W3164952570
- Cited by
- 748
- References
- 3
- Citations by year
- 2026: 131 · 2025: 252 · 2024: 220 · 2023: 99 · 2022: 42 · 2021: 4
- FWCI
- 6.54
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Open UAE research group, University of Sharjah
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- anomaly detection, machine learning models, unsupervised anomaly detection, performance indicators, research guidelines
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review