Edge Computing for Real-Time IoT Anomaly Detection in Smart Cities

Thesis Abstract

This study investigates the deployment of edge computing for real-time anomaly detection in Internet of Things (IoT) installations across smart city environments, addressing the challenge of timely and accurate identification of anomalous sensor behavior while reducing centralized cloud dependency and network latency. The problem is rooted in the need to detect safety-critical and operational anomalies—such as traffic sensor faults, environmental parameter outliers, and device compromise—within the stringent latency bounds required for autonomous control and urban management systems. The aim is to design, implement, and evaluate an edge-assisted anomaly detection framework that leverages distributed processing, online learning, and explainable AI to enhance detection accuracy, reduce false positives, and enable rapid incident response. Specific objectives include (1) to develop an edge-centric architecture that supports local feature extraction, incremental model updating, and secure data transmission; (2) to compare supervised, unsupervised, and semi-supervised learning approaches for real-time anomaly detection on resource-constrained edge devices; (3) to assess the impact of data heterogeneity and concept drift on detection performance over time; (4) to evaluate latency, energy consumption, and fault tolerance under varying network conditions; and (5) to provide actionable guidelines for deployment in heterogeneous urban IoT ecosystems. The methodology adopts a mixed-methods, field-oriented design conducted in three metropolitan districts with diverse IoT deployments, comprising a population of approximately 2,500 edge-enabled sensors and gateways across transportation, environmental monitoring, and public safety domains. A stratified sampling strategy yields 40 representative edge nodes for in-depth experimentation, supplemented by synthetic fault injection to simulate anomalies at scale. Data collection employs (i) continuous streaming telemetry from sensor benches, (ii) labeled incident records from city operation centers, and (iii) resource metrics (CPU, memory, energy) from edge devices over a nine-month observation period. Instruments include a standardized anomaly labeling schema, real-time logging dashboards, and a suite of API-driven measurement tools. Validity and reliability are ensured through calibration against a ground-truth dataset, cross-validation across three distinct city sectors, and repeatability of experiments using containerized edge environments. Analytical procedures combine statistical and machine learning techniques. Descriptive statistics summarize data characteristics and incidence rates of anomalies. For predictive modeling, a comparative evaluation of online algorithms is conducted, including incremental k-means, isolation forest, one-class SVM, and online gradient-boosted trees, augmented with concept-drift detection using DDM and EDDM methods. A hierarchical ensemble approach aggregates local edge decisions with a central aggregator, applying weighted majority voting and confidence scoring to produce robust detections. Temporal analysis employs time-series methods such as ARIMA and Prophet to model normal sensor behavior, while causality-inspired analysis investigates antecedent conditions using Granger causality tests. Explainability is addressed via SHAP analysis and model-agnostic explanations to ensure operator trust. Performance is measured against key metrics detection latency (ms to decision), detection accuracy (F1-score), false positive rate, energy consumption per inference, and system resilience under network interruptions. The study also models the cost-benefit implications of edge versus cloud processing through a simple stochastic cost model. Expected findings indicate that edge-enabled, online ensemble methods outperform cloud-centric baselines in latency and resilience, with acceptable accuracy trade-offs under constrained compute. The investigation anticipates that incorporating drift detection improves long-term performance, while hybrid local-global architectures balance immediacy and global situational awareness. Theoretical contributions are framed within the context of distributed AI and edge computing diffusion, extending the application of the contextual anomaly detection paradigm to heterogeneous urban IoT ecosystems. Practically, results provide deployment guidelines for city planners and operators, including resource provisioning, security considerations, and model governance protocols. The study concludes that edge-centric anomaly detection enhances real-time situational awareness in smart cities, enables faster incident response, and reduces data movement to the cloud without compromising detection quality. Recommendations include standardized interfaces for heterogeneous sensors, adaptive sampling strategies to manage energy budgets, and ongoing model retraining mechanisms to mitigate concept drift, alongside avenues for future work on transfer learning across districts and deeper exploration of explainable AI in mission-critical urban contexts.