对比三种预处理方式对物联网异常检测模型的影响，找到最优组合。
A Multi-Step Comparative Framework for Anomaly Detection in IoT Data Streams
- 设计多步评估框架，系统测试归一化、变换和特征选择对模型的影响。
- 梯度提升模型在所有预处理下表现最佳，自编码器召回率最高。
- 适合需要高召回的物联网安全场景，为模型选型提供实证依据。
物联网设备的快速扩张带来了严峻的安全挑战，亟需精准的异常检测方法。尽管已有大量机器学习方法被提出，但缺乏对不同预处理步骤（如归一化、变换、特征选择）与不同模型架构之间相互作用的系统性研究。本文提出一个多层次评估框架，分析预处理策略对三种机器学习算法（RNN-LSTM、自编码神经网络、梯度提升）的影响。在IoTID20数据集上的实验表明，梯度提升模型在各类预处理配置下均表现最优；RNN-LSTM在z-score归一化下显著提升性能；自编码器在召回率方面表现突出，适用于无监督场景。该框架为物联网环境中的异常检测提供了可操作的优化指导。
原文摘要 · Abstract (English)
The rapid expansion of Internet of Things (IoT) devices has introduced critical security challenges, underscoring the need for accurate anomaly detection. Although numerous studies have proposed machine learning (ML) methods for this purpose, limited research systematically examines how different preprocessing steps--normalization, transformation, and feature selection--interact with distinct model architectures. To address this gap, this paper presents a multi-step evaluation framework assessing the combined impact of preprocessing choices on three ML algorithms: RNN-LSTM, autoencoder neural networks (ANN), and Gradient Boosting (GBoosting). Experiments on the IoTID20 dataset shows that GBoosting consistently delivers superior accuracy across preprocessing configurations, while RNN-LSTM shows notable gains with z-score normalization and autoencoders excel in recall, making them well-suited for unsupervised scenarios. By offering a structured analysis of preprocessing decisions and their interplay with various ML techniques, the proposed framework provides actionable guidance to enhance anomaly detection performance in IoT environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。