Unsupervised One-Class Learning for IoT Intrusion Detection: A Review of Methods and Prospects

The rapid proliferation of the Internet of Things (IoT) has heightened the need for intrusion detection systems capable of operating within stringent computational, memory, and energy constraints.One-Class Learning (OCL) has emerged as a promising approach for IoT security, as it models only benign behavior and remains effective when attack samples are scarce, irregular, or evolving.Despite increasing interest in OCL, existing studies focus primarily on detection accuracy and offer limited insight into the practical deployability of these models across heterogeneous IoT environments.This review provides a deployment-oriented synthesis of OCL techniques for IoT intrusion detection system (IDS).It introduces a structured taxonomy spanning shallow learning (SL), representation learning (RL), and deep one-class neural architectures (OC-DNN), and consolidates evidence from widely used IDS datasets.A unified evaluation framework is proposed, assessing computational complexity, inference latency, memory footprint, and suitability for edge deployment.The findings presented establish a clear foundation for developing OCL-based intrusion detection systems that are both computationally efficient and operationally viable for real-world IoT ecosystems.