Anomaly classification in industrial Internet of things: A review

Abstract

ABSTRACT: The fourth industrial revolution (Industry 4.0) has the potential to provide real-time, secure, and autonomous manufacturing environments. The Industrial Internet of Things (IIoT) is a powerful tool to make this promise a reality because it can provide enhanced wireless connectivity for data collection and processing in interconnected plants. Implementing IIoT systems entails using heterogeneous technologies, which collect incomplete, unstructured, redundant, and noisy data. This condition raises security flaws and data collection issues that affect the data quality of the systems. One effective way to identify poor-quality data is through anomaly detection systems, which provide specific information that helps to decide whether a device is malfunctioning, a critical event is occurring, or the system's security is being breached. Using early anomaly detection mechanisms prevents the IIoT system from being influenced by anomalies in decision-making. Identifying the origin of the anomaly (e.g., event, failure, or attack) supports the user in making effective decisions about handling the data or identifying the device that exhibits abnormal behavior. However, implementing anomaly detection systems is not easy since various factors must be defined, such as what method to use for the best performance. What information must we process to detect and classify anomalies? Which devices have to be monitored to detect anomalies? Which device of the IIoT system will be in charge of executing the anomaly detection algorithm? Hence, in this paper, we performed a state-of-the-art review, including 99 different articles aiming to identify the answer of various authors to these questions. We also highlighted works on IIoT anomaly detection and classification, used methods, and open challenges. We found that automatic anomaly classification in IIoT is an open research topic, and additional information from the context of the application is rarely used to facilitate anomaly detection.