DRNN is an in-depth learning approach used to analyze network attacks, such as denial-of-service attacks, denial-of-sleep attacks, and ping-of-death attacks, that occurred against IoT gateways and identify the method that detects network attacks. Similarly, DRNN also captures the affected packet with more accuracy after predicting the attack. In this scenario, the attacker sends the bundle of packets to the oversized destination to bring the system down on the destination side. For testing purposes, captured packets are used in which attacks are inserted to evaluate DRNN [13].

In this study, we provide a probabilistic generative method that uses community membership as a foundational model for typical behavior and alerts to possible anomalies that deviate from this pattern. In fact, a null model to detect regular interaction patterns uses community membership as one of its fundamental building blocks. Through latent variables for community membership and the anomaly parameter, structural information is included in the model. The method seeks to infer these latent parameters, and then it outputs labels that indicate abnormalities at the network’s edges [24].

A powerful, large data anomaly detection technique built on a modified version of the CluStream clustering algorithm. In the suggested approach, Redis clusters are utilized to store all the data during the online stage and iteratively update the data over time. The K-means clustering technique is designed to decrease time complexity while the cluster centers are swiftly determined using the optimal-distance approach during the offline stage. The results of the experiments show that the suggested approach is speedier than the original CluStream clustering algorithm and can discover outliers in huge data with accuracy [26]. CluStream is also used to examine the clusters by extracting their micro-cluster information within a specific time sequence [37].

A deep learning model is used for the detection of cyberattacks by using the fog ecosystem. This model is resilient to cyberattacks because of its high capability of feature extraction and discovering hidden patterns from training data, so attacks are easily identified. Whereas the shallow model can also do this but has a lower accuracy rate than the deep learning model, deep learning has outclassed the shallow model with a higher accuracy rate for detecting cyberattacks [23]. The end-to-end deep learning model is presented to detect anomalies in temporal data. The proposed model is based on the Extreme Value Theory of Long Short-Term Memory (EVT-LSTM), which is derived from Long Short-Term Memory (LSTM). The experimental analysis is performed on seven real-world datasets to compare the proposed technique with other machine learning and hybrid deep-learning methods [38]. A deep learning method is discussed for analyzing data security and predicting anomalies in the network. This model predicted the anomaly in the future network. For experimental analysis, a public dataset and the analyzed method provide effectiveness and management strategies for network controllers [39].

A method of intrusion detection is described using a Deep Neural Network (DNN), a meta-classifier, and LSTM. The adopted method performs two primary tasks for anomaly detection. First, a Deep Sparse Autoencoder (DSAE) is used for feature engineering. The second step is a classification that can be performed with a stacking ensemble learning approach. Three different datasets are used for experimental analysis for anomaly detection, such as IoT-23, LITNET-2020, and NetML-2020 [40].

This study examines the use of the unsupervised K-means clustering algorithm to find anomalies in the healthcare industry and accurately forecast heart disease. The silhouette approach is used in the proposed model to first establish an ideal value of K before forming the clusters needed to detect abnormalities. The suggested model then uses the five most prominent machine learning approaches, including K-nearest neighbor, random forest, support vector machine, naive bayes, and logistic regression, to develop the final prediction model after removing the observed anomalies from the data. Using a typical dataset for cardiac illness, the effectiveness of the suggested technique is supported. In order to assess the accuracy of finding anomalies in our experimental study, the researcher also takes data plotting into consideration [41].

The Naïve-Bayes method is implemented to identify the relationship between dependent and independent variables. In contrast, the Naïve-Bayes classifier is also used to classify data according to its potential group. Heart disease increases around the world and causes death on a large scale. The Naïve-based method is used and compared to diagnose heart disease with other data mining techniques, such as DT and neural networks. Naïve-Bayes achieved the best result in diagnosing heart disease. K-mean is also used to detect outliers in heart patient diagnosis [42]. It is also investigated that integration of Naïve-Bayes techniques with boosting and bagging enhances the Naïve-Bayes classifier to diagnose liver disease [43].

The k-means clustering integrated with Naïve Bayes is used to diagnose the heart diseases of the patient. In this mechanism, the initial centroid selection (outlier, range, attributes, etc.) is critical due to its effects on better results.

Nowadays, the IoT device usage is increasing and needs to make the IoT infrastructure more stable and secure. A model capable of detecting malicious activities and performing intrusion detection in IoT networks is critical for IoT networks like User-to-Root (U2R). The model performs linear discriminate analysis and component analysis to reduce the high-dimensional dataset to lower features. Similarly, two-tier classification used Naïve Bayes and k-nearest neighbor algorithms to identify suspicious and malicious behaviors [16].

The technique U-Brain is used to understand and monitor the process that originates from data traffic. Thus, the U-Brain can quickly detect both normal and abnormal activities based on the training dataset. Additionally, U-Brain allows a specific amount of uncertainty to manage online network traffic complexity to make the system more reliable [21]. Chapple et al. [44] generated a diurnal network access model that detects authentication anomalies after user attempts at the login side. Identifying anomalies or anomalous connections can be made on the university network with the clustering method. Table 2 describes a brief overview of the approaches mentioned above, along with areas discovered and remarks. The purpose of these areas is to determine the applicability of a specific strategy regarding any network anomaly or outlier. Furthermore, remarks highlight the pros and cons of the approach concerned.

Mathematical Formulation of Network Anomaly Detection

Let X ε Rm×n represent the input feature matrix, where m is the number of samples and n is the number of features. However, f(xi;θ) maps the input features to a prediction y^i, which indicates whether the input is normal (0) or anomalous (1) as mentioned in Eq. (2). However, the sample xi ε Rn is expressed as: (1)xi=[xi1,xi2,xi3….,xin]where xi is the feature vector of the ith instance (2)y^i=f(xi;θ)where f outputs either a probability (with respect to neural network and logistic regression) or DT and SVM.

The rule for classification is described in the binary form: (3)y^i={1,ifanomalyisdetected(attack)0,ifnormaltraffic

Similarly, by reducing loss (L (hinge loss or cross entropy)), the ML and DL models find the optimal model parameters (θ) during the training process. The loss can be measured as the difference between true (yi) and predicted labels (y^i). (4)L(θ)=1m∑i=1ml(yi,y^i)

However, the optimization process can be done by updating the parameter θ with the help of a gradient-based or iterative method. (5)θ←θ−η.∇θL(θ)

Finally, the solution can be obtained by setting a threshold (τ) for the classification of network traffic as mentioned below. Here (τ) is considered to be a threshold determined with respect to the validation. (6)y^i={1,iff(xi;θ)≥τ0,iff(xi;θ)<τ

A generic Algorithm 1 for network anomaly detection is discussed as follows:

Fig. 4 shows that the performance trade-off in the deep learning-based anomaly detection is evident through the comparative analysis. Dutta et al. Hybrid Ensemble attains the highest accuracy of 99.0% with a heavy penalty both in terms of computational cost and complexity (Score 4), which substantiates the high cost of ensemble models. Although D’Angelo et al. U-BRAIN method is very complicated (Score 5), it has a high accuracy of 94.1% at a relatively lower cost of computation (Score 2) when compared with the other deep models. On the other hand, the Davis et al. EVT-LSTM and Brun et al. DRNN techniques suggest that there was a high complexity and accuracy of 90–100%, and, therefore, graphical visualization was needed to demonstrate these subtle performance attributes.

For health analytics, smartphones have been developed and deployed. Several built-in sensors include Photoplethysmography (PPG), Global Positioning System (GPS), accelerometer, magnetometer, and heterogeneous sensors to measure and monitor the health condition for exercise planning regarding the situation. If receiving or facing anomalous events or conditions, like sudden increases in energy consumption, the smartphone will alert [14].

Heart rhythm and heart rate are important parameters for detecting cardiac anomalies and for the health monitoring process. The development of smartphones with high-profile cameras has led to their usage for medical diagnoses to effectively and smartly detect cardiac anomalies and heart health. It is reported that there are effective mechanisms to utilize smartphones for monitoring heart health. A programmed Python application was designed to acquire the heart rate using the camera and data processing. The Power Spectrum Density (PSD) and Welch periodogram computation were performed to estimate the heart rate. Then, for the calculation of heart rate variability, three time-domain and two frequency-domain methods were used to detect atrial fibrillation by evaluating heart rate variability based on variability results and comparing various medical standards and facts [45].

Implementing a Wireless Sensor Network (WSN) to monitor and select heart health and related medical conditions is presented. The proposed implementation of wireless sensor networks is based on Haar wavelet decomposition, non-seasonal Holt-Winters forecasting, the Hampel filter for spatial analysis, and temporal analysis. The system can process the sensors’ data to estimate the condition of the patient for particular diseases and generate an alarm for the medical care team in emergencies. The heart rate, respiration rate, oxygen saturation in the blood, blood pressure, body temperature, and electrocardiogram are essential for diagnosing heart health and other related medical conditions. Various invasive and non-invasive sensors are available on the market to collect data from the patient’s body in the wired and wireless modes of operation, which can be interfaced to a centralized diagnostic and mitering system [46].

Various anomaly detection classification techniques, like the Hidden Markov Model (HMM) and Support Vector Machine (SVM), can detect cardiac anomalies. At the same time, the wrapper or hybrid method could enhance the efficiency of classification models. The researchers further presented the design of optimal feature selection by using a robust learning technique. This maximizes classifiers’ performance and effectively reduces phonocardiogram signals’ noise for optimal hybrid feature selection to identify the heart’s normal or abnormal state automatically. The author claimed 85% anomaly detection accuracy [47].

A tool with a sensor framework is designed for impaired people. The usual ultrasonic sensor detects objects or hurdles that will appear near the blind man. The smart can also have a water sensor; this achievement makes it different from other visually impaired people. Smart canes can also be foldable and held more comfortably [31]. A smart cane, which is lightweight and inexpensive, receives signals and beeps in various patterns to warn the blind of any obstacles, potholes, or water puddles. It detects the level of ambient light and adjusts the Light Emitting Diodes (LED) illumination appropriately. These are achieved by combining an Arduino Nano microcontroller with two ultrasonic sensors, a moisture sensor, and a Light Dependent Resistor (LDR) sensor. These are positioned strategically along the cane for effective direction. In addition, a Global System for Mobile Communications (GSM) module is included in the system so that, in an emergency, a visually impaired person may send a message to the emergency contact number. Eighty percent of customers were happy with the prototype’s accuracy, which the evolved model demonstrated at a rate of 89% [48]. The design of a smart cane for visually impaired people is presented. Interfacing sensors have implemented the design with Arduino. The reported smart cane can detect holes and obstacles and give indications of direction to the blind person with the help of sound beeps at different intervals for different signals [49]. It was also reported that a smart cane design for blind people for obstacle detection was interfaced with an ultrasonic sensor with a Field Programmable Gate Array (FPGA) [50].

The device is designed for the impaired person who accurately provides awareness and guidance according to the new environment. The device consists of a GPS and a Geographic Information System (GIS) to accurately determine a blind person’s position and fulfill the blind person’s needs according to the unknown environment with navigation [32]. A wearable device helps visually impaired people detect objects and navigate to determine a clear and safe path. Whereas CasBlip has two modules that include a sensor module that consists of an image sensor and a laser beam for detecting an object, and an acoustic module that provides environmental information regarding the object’s location and converts the information into a sound format [34].

A head-symptomatic approach is used to detect manufacturers and operational anomalies; it exists between the current supply of smart devices and characteristics that make the device functional. This approach is implemented to check the exploitation of current collections and provide a warning in the form of a deviation [36]. A machine learning model is discussed in order to detect anomalies and attacks in the IoT environment. However, machine learning models, including decision tree (DT), artificial neural network (ANN), Random Forest (RF), logistic regression (LR), and SVM, are used for anomaly and attack detection. It is concluded that DT, RF, and ANN performed better and achieved the highest accuracy than other models. Furthermore, it is also highlighted that RF performance is comparatively much better [51].

The primary purpose of using decentralized anomaly detection is to detect sensor node anomalies to reduce energy, rather than detect them in a centralized manner. For doing this, information can be collected with a neighborhood’s help for finding in-node anomalies [35]. This study intends to shed light on Human Activity Recognition (HAR) literature because of publications made after 2018. To highlight application areas, data sources, methodologies, and open research issues in HAR, the 95 publications assessed for this study were divided into several categories. Daily living activities appear to have received most of the attention in the literature, followed by user activities centered on individual and group-based activities. However, there is scant research on real-time tasks, including surveillance, healthcare, and suspicious activity. Data from mobile sensors and Closed-Circuit Television (CCTV) footage have been extensively used in previous research. The three most well-known methods used for HAR are CNN, LSTM, and SVM. Finally, but not least, the constraints and unresolved issues that need to be handled are presented in this research [52].

The demand for autonomous decentralized systems is increasing rapidly to detect anomalies on the industrial Ethernet. An approach has been presented that builds a traffic model for the chemical industry. This model decomposes the time series into four items that are produced by a stationary analysis. Furthermore, a space model, standard Kalman filter recursions, and an Expectation Maximization (EM) algorithm are also used for parameter identification. The techniques are evaluated and have a significant result in the detection of abnormalities [53].

A mechanism that predicts viral diseases like Severe Acute Respiratory Syndrome (SARS), Middle East Respiratory Syndrome (MERS), and COVID-19 is being discussed. In this method, the CAAD model is used to detect anomalous behavior. This method consists of a feature extractor, an anomaly detection module, and a confidence prediction module. However, these modules help to predict viral as well as non-viral pneumonia. If the anomaly detection module’s score is high and the score confidence prediction module is small, this case is considered an anomaly in viral pneumonia. The experiments were performed on the X-VIRAL dataset to predict viral or non-viral cases [54].

A transfer learning method is applied to Computed Tomography (CT) scan images for disease detection, like COVID-19. In this method, COVID-19 is detected in three phases. The first phase is the data augmentation with the stationary wavelets, and then a convolutional neural network is applied for the detection of COVID-19. Finally, the abnormality can be determined from CT scan images [55].

A method for the detection of COVID-19 using deep learning is presented. In this method, a decision-tree classifier (DTC) is adopted for the detection of COVID-19 from Chest X-ray Radiography (CXR) images. The classifier is divided into three binary DTs. The first DT differentiates between normal and abnormal images. The second DT predicted the tuberculosis sign, while the third identified the COVID-19 signs. The adopted method is helpful for pre-screening the patients [56]. Table 3 provides a brief overview of anomaly detection methods.

Mathematical Formulation of Sensor-Based Anomaly Detection

Sensor Data Collection

Let there be K different sensors, each generating time-series data: (7)X=[X1||X2||X3||……. ||Xk∈RT×Nwhere ∘

Xi={xi1,xi2,xi3,….xiT}:Data from the ith sensor over time

Feature Extraction

Raw data conversion into informative features: (8)Z=ϕ(X)∈RT×dwhere:

ϕ(⋅): A general feature extraction function (e.g., transformations, statistics, frequency analysis)

Prediction Function

A mapping function f is applied to extracted features to estimate anomaly labels: (9)y^t=f(Zt;θ)where:

Zt: Feature vector at time t

Loss Function

The model is trained to minimize the discrepancy between predicted and actual labels: (10)L(θ)=1T∑t=1Tl(y^tyt)where:

yt: True label at time t

Parameter Optimization

Model parameters are updated to minimize loss: (11)θ←θ−η.∇θL(θ)where:

η: Learning rate

Rule Decision

A threshold τ is used to classify predictions as anomaly or normal: (12)y^t={1,iff(Zt;θ)≥τ0,Otherwsie

A generic Algorithm 2 for sensor-based anomaly detection is discussed as follows:

As shown in Fig. 5, Complexity and Computational Load Intensity are closely intertwined, particularly in the various application domains. Most of the application-specific and focused models, including the CAAD model, DTC, and Smart Cane, have the least complexity and computational load (Score 1), which implies that they are efficient, but could imply limited scope. On the other hand, approaches that address large, complex data, such as the Bosman et al. Unsupervised Spatio-temporal AD and Ukil et al. Cardiac AD requires a lot of complexity and computing power (Scores 4–5) because of the “significant processing resources” required to run the advanced signal processing and spatio-temporal analysis. This trend highlights an important trade-off, namely that efficiency may be attained at the cost of generalizability and ability to process complex, high-dimensional data.

The local outlier factor (LOF) technique identified the suspicious object’s local density that its neighbors’ local density can notice. Therefore, for analyzing breast cancer, four algorithms (LOF, Order Points to identify clustering structure (OPTICS), Density-based Spatial Clustering of Applications with Noise (DBSCAN), and Density-based Clustering (DENCLUE)) are used and compared based on various parameters. For implementation purposes, a breast cancer dataset is used. Results show that the optics algorithm performs very well, but checking the number of outliers’ closeness with actual data, the LOF performs better [58].

The detection of an outlier in web video is gaining much attention among researchers. Several outliers and abnormalities emerged in various types of web videos, like sports, news, etc. To identify the outliers that exist in such types of videos, a density-based LOF method is adopted. The method detects the outlier based on the object that existed in the metadata. After that, LOF is used with multiple nearest-neighbor values to discover the anomaly in web videos [59].

Furthermore, the dense trajectory can be applied to video scenes for computing purposes to build the fixed-length descriptor of each frame and then generate bags of visual words. Afterwards, SVM is applied for the separation of suspicion clusters [28].

In surveillance videos, the detection of anomalous trajectories in traffic scenes, like the wrong U-turn, is essential. Presently, a general potential data field-based trajectory is used for clustering abnormal events and anomalous behavior. It has several limitations, like limited range estimation with the help of a factor that produces inaccuracy in the result, and a defined cluster size. The General Potential Data field with Spectral Clustering is adopted. This technique provides a 12% more accurate result in the detection of abnormal events [32].

An innovative technique for supporting classification machine learning algorithms creates an anomaly-based NIDS detection model, therefore identifying the aberrant SH IoT device network behavior. In a simulated SH test-bed scenario, three network-based assaults were utilized to gauge the effectiveness of our NIDS solution. The detection model produced using conventional and ensemble machine learning (ML) techniques performs exceptionally well overall. All detection models have greater than 98.8% accuracy [19].

In this research, a deep representation method for solving the issue is proposed. This method extracts and represents features in an unsupervised manner. This algorithm is capable of spotting odd behavior, such as lingering and standing still in a crowded area. Our suggested framework uses feature channels that were taken from the appearance and foreground of the original video and is a two-channel system. In order to learn the high-level feature representation automatically and generate two anomaly scores for these two channels, two hybrid deep learning architectures, called a four-layer stacked de-noising auto-encoder with three-layer deep belief networks, and a plane-based one-class support vector machine (SDAE-DBN-PSVM), are implemented. For merging anomaly scores and identifying anomalous events, a fusion strategy is then provided. This method’s efficacy has been tested using findings from two benchmark datasets (UCSD and Subway) and a sizable real-world dataset (MCG). The impacts of the volume of training data and the video’s lighting conditions on the precision of anomaly identification are also quantitatively analyzed and displayed [60]. Automatic event detection is popular in various types of applications, like sports and TV clips. For the detection of events, One Class Support Vector Machine (OCSVM) clustering is adopted to detect anomalous trajectories [58]. However, a support vector machine is also used to analyze the video and detect the vehicle’s abnormal behavior in traffic with vehicle trajectories [61].

The mean-shift algorithm is used for detecting abnormal behavior in a video, where each clip is of a fixed length. Videos are generated in the form of visual bags with the help of k mean hard quantization, then the mean-shift algorithm is applied in a repeated manner for the sake of improving the level of an anomaly by modifying and classifying the abnormal activities based on their location and weights. An anomaly with a high point is considered a novel [28].

Road anomalies can be detected by using the Grubbs test. The mean shift algorithm is used for data combining to find the anomalies’ positions from multiple clusters [62]. An approach has been presented that detects anomalous trajectories that exist in crowded scenes. This approach used four steps to detect anomalies. Firstly, the extraction of a moving object is done with an object tracker that extracts the object based on multiple features. After that, the mean shift algorithm is applied to get the distinct objects based on features. Finally, anomalies can be detected using a Shannon entropy-based anomaly detector [63].

STIP is a robust algorithm that is used for the recognition of humans and generating video summaries. STIP can detect the moving object from the video directly, rather than using foreground segmentation and modeling. A distribution does the extraction of STIPs based on velocity and locations, which are used for classifying abnormal behavior in a video. STIPs are the primary key to detecting exciting points in the video. Many applications (recognition of human action, surveillance videos, and précising the video) exist in which this technique is implemented to detect informative points. Therefore, a comprehensive overview of the STIPs algorithm and challenges has been discussed [27]. To provide important information in videos, particular spatio-temporal interest points and sparse convolutional coding are presented. Results demonstrated that both of these approaches performed well in identifying anomalous events [37].

A method of detecting abnormal behavior by using deep learning methods is described. In this paper, a Spatial Temporal Convolution Neural Network (STCNN) is used. This model first processes the surveillance images by using the aggregation channel feature model. After that, a suspected object region is detected with the help of feature extraction, and finally, SVM classification is performed to predict the abnormality [64]. A deep learning method for anomaly detection in real-time videos is discussed. In this method, the Incremental Spatio-Temporal Learner (ISTL) detects normality and anomalies over time. However, this method is suitable for real-time surveillance videos [65].

A DNN is used to define and identify normal behavior in videos. In contrast, DNN can also detect the future frame based on previously detected frames, so the model’s prediction can be made by comparing the video with the testing results. Different frames or errors are considered an anomaly in this scenario [29]. The DNN model is also used for anomaly detection. After the detection of the anomalies, a system-generated alarm is raised for security purposes. This method has low cost and high accuracy, like more than 90% [66].

The approach used for intelligently recognizing indoor and abnormal outdoor activities, especially understanding human activity, is feature extraction, so detection can be done using two steps: representation of behavior and modeling it. The first step describes behavior. The second step uses the methods of classification for behavior modeling by providing semantic information. Finally, it determines whether the behavior is normal or abnormal [9]. The researchers provide a two-stream method that offers an auto-encoder-based framework for quick and effective anomaly identification from surveillance video without tagging anomalous occurrences. Additionally, post-hoc interpretability of feature map visualization is used to demonstrate the feature learning process, exposing unclear and uncertain decision boundaries in the video series. Experimental findings on the Avenue, UCSD Ped2, and Subway datasets demonstrate the effectiveness of the applied strategy in identifying anomalous occurrences and elucidating the underlying workings of the model at the object level [17].

The crime rate is increasing nowadays. Therefore, there is a great demand to install surveillance cameras at different places, like schools, airports, etc. That works 24 h a day, on all days of the week, to monitor activity in the environment. There is a limitation in consistently detecting the anomalous content in the video. An approach has been presented that automatically detects the anomalous activity in three major steps. First, the object can be detected in a motion state, and second, object tracking is performed. Third, the activity can be identified by understanding the behavior. The feature extraction is used to extract key features like speed, dimension, etc. This helps with tracking the object. Finally, the dominant features are selected from the videos. However, the system provides accuracy up to 90% [30].

The deep learning approach is used for detecting anomalies in surveillance videos. For doing this, the Multidimensional Inequality Framework (MIF) framework is used for visual features and extracts normal and abnormal activities [67]. A framework is presented that separately detects local as well as global anomalies. For global anomalies, kinetic energy and the computation of the first derivative of kinetic energy are used to find the global anomaly by computing each frame score. After that, the anomaly can be detected by categorizing the local anomaly into three more categories: appearance, velocity, and location anomaly. These anomalies can be detected by extracting various features. Finally, identify abnormalities from the video [68].

The Gaussian Mixture model is used for detecting objects, such as those that involve crawling, walking activities, and foreground. Therefore, object direction and patterns are used to detect suspicious events. After that, it classifies the data into a normal or abnormal form. The alarm is produced to detect abnormal or suspicious events [30]. The Gaussian Mixture Model is used with other techniques for comparison to detect an object that is in a moving state in the video. This model is efficient, even for detecting complex situations, dynamic objects, and objects in shadow [69]. A Gaussian mixture model is presented to extract normal behavior from the crowded videos. The model robustly extracts the motion from the dynamic scenes. Motion features that do not fit in normal scenes are considered anomalies [70]. Table 4 provides a brief overview of visualization approaches, along with discovered areas and remarks.

Generic Mathematical Formulation for Video Anomaly Detection

Video Data Collection

The video is a sequence of frames over time. Let the video data be represented as: (13)V={F1,F2,F3……,FT}where:

FT∈RH×C×W is the video frame at time ttt

The spatio-temporal block or segment can be defined as: (14)Bi={Ft,Ft+1,……,Ft+Δt}

Feature Extraction

Each segment Bi is transformed into a feature representation: (15)Zi=ϕ(Bi)∈Rdwhere:

ϕ(⋅): A general feature extraction function capturing motion, appearance, and temporal changes

Anomaly Score Estimation

Each feature vector Zi is mapped to a score or prediction using a general function: (16)si=f(Zi;θ)where:

f: A general decision function (learned or unsupervised)

Loss Function (for Training, if Supervised or Semi-Supervised) (17)L(θ)=1N∑i=1Nl(yisi)where:

l (⋅): A loss function measuring the difference between predicted score and ground truth

Parameter Optimization

Parameters are optimized via a general rule: (18)θ←θ−η.∇θL(θ)

where:

η: Learning rate

Anomaly Detection Decision

A threshold τ is used to classify predictions as anomaly or normal: (19)y^t={1,ifsi≥τ(Anomlay)0,ifsi≤τ(Normal)

The flow diagram of proposed anomaly detection flow diagram is mentioned is as in Fig. 6. Moreover, a generic Algorithm 3 related to video anomaly detection is also discussed as follows:

The visualization and data in Fig. 7 show that there is a distinct dichotomy in the resource demands. Basic algorithms such as the Mean-shift Algorithm (74.83%–76.71% Accuracy) are efficient and hence have the lowest score in Complexity and Computational Cost (Score 1). On the contrary, deep learning-based methods, such as STCNN (79.88% Accuracy) and the ISTL (91.1% Accuracy) of Hu. Fall at the upper end of the resource range (Score 4 in both measures), which is directly correlated with their “high computational needs” and their highly sophisticated character. The Gaussian Mixture Model is what takes an important middle ground in the sense that it can be highly accurate (approximately 90.0%), at respectively moderate cost and complexity (Score 3), and the major drawback of the model is its scalability by its complexity, which makes it more scalable.