Internet of Things and Deep Learning for Citizen Security: A Systematic Literature Review on Violence and Crime

Abstract

This study conducts a systematic literature review following the PRISMA framework and the guidelines of Kitchenham and Charters to analyze the application of Internet of Things (IoT) technologies and deep learning models in monitoring violent actions and criminal activities in smart cities. A total of 45 studies published between 2010 and 2024 were selected, revealing that most research, primarily from India and China, focuses on cybersecurity in IoT networks (76%), while fewer studies address the surveillance of physical violence and crime-related events (17%). Advanced neural network models, such as Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, and hybrid approaches, have demonstrated high accuracy rates, averaging over 97.44%, in detecting suspicious behaviors. These models perform well in identifying anomalies in IoT security; however, they have primarily been tested in simulation environments (91% of analyzed studies), most of which incorporate real-world data. From a legal perspective, existing proposals mainly emphasize security and privacy. This study contributes to the development of smart cities by promoting IoT-based security methodologies that enhance surveillance and crime prevention in cities in developing countries.

1. Introduction

Smart cities are distinguished by their ability to integrate digital technologies [1], communication systems [2], and big data analytics tools [3] to create an efficient and sustainable urban environment that enhances well-being and improves the quality of life for their inhabitants [4]. In this context, the Internet of Things (IoT) and deep learning represent emerging paradigms that significantly contribute to the transformation of traditional cities into intelligent ecosystems. IoT facilitates the interconnection of physical devices through sensors and software to collect real-time data [5], while deep learning leverages artificial neural networks to analyze vast volumes of data, extract meaningful insights, and identify patterns that support decision-making processes [6] in a manner akin to human cognition.

In the realm of security management within smart cities, one of the most significant technological advancements enabling the monitoring of citizen activities in peripheral areas is IoT. By utilizing interconnected cameras and sensors, IoT enables continuous, 24/7 surveillance to enhance public safety [7]. Additionally, artificial intelligence (AI), with its capacity to recognize patterns and learn through deep learning-based neural network models, plays a critical role in detecting suspicious behaviors [8] and identifying violent actions or criminal activities [9,10]. AI-powered systems contribute to real-time threat prevention in smart cities [11] by analyzing digital images and video footage collected via IoT technologies. Moreover, these systems facilitate risk behavior detection and optimize security resource allocation, including the deployment of security personnel, the acquisition of police patrol vehicles, and the automation of emergency response systems [12].

Given this background, it is evident that the integration of deep learning and IoT in smart cities has fundamentally transformed public security management, enabling the collection and analysis of large-scale data to provide timely responses to incidents. However, critical challenges remain, particularly regarding the adaptability of deep learning models to the complexity and diversity of incidents in densely populated urban environments with varying levels of risk [13]. Additionally, disparities in the deployment of technological infrastructure across urban spaces—such as those found in many Latin American cities and other regions worldwide—pose significant implementation barriers.

In Latin America, crime rates have risen by 30% over the past decade [14], and the adoption of advanced security technologies powered by deep learning has the potential to reduce these rates by 15–20%. The application of deep learning models in security management shows promise in lowering crime rates and improving urban quality of life. Studies conducted in cities such as Chicago, New York, and Lahore suggest that spatiotemporal crime analysis using machine learning techniques can reduce crime rates by up to 25% in densely populated urban areas, achieving an accuracy of 93.37% in crime scene pattern recognition [15]. Similarly, a study conducted in Greece demonstrated that deep learning architectures attained an average accuracy of 94%, outperforming traditional crime prediction methods [16]. These findings underscore the effectiveness of deep learning techniques in crime forecasting and prevention. However, these systems still face significant challenges related to data security and privacy in IoT networks, as well as limitations in accuracy, scalability, and adaptability to effectively address diverse incidents and mitigate false alarms [17]. Therefore, a comprehensive study is needed to systematically organize and evaluate information regarding the implementation of IoT and deep learning-integrated systems for public security management.

The lack of dedicated research that systematically compiles and organizes the literature on the application of deep learning and IoT in urban security monitoring and management limits access to prior experiences that could inform the potential of these systems in addressing rising crime rates in complex environments. While existing studies explore IoT and AI in general terms, few specifically focus on how deep learning can optimize the accuracy of crime pattern detection and incident prediction. To bridge this gap, this study seeks to answer the following research question: How can deep learning strengthen public security and safeguard data in smart cities? This question is addressed through five sub-questions aimed at analyzing how intelligent systems integrating IoT and deep learning have been effective in managing violence and crime in urban settings.

Thus, this study aims to examine existing implementations of deep learning models applied to violence and crime monitoring systems in IoT-based smart cities, following the guidelines established by PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) [18] and the methodology proposed by Kitchenham and Charters [19]. These methodological approaches—widely employed in systematic reviews within the field of Computer Science—were used to design and implement a scientific search protocol across databases, including Scopus and Web of Science. This protocol enabled the identification of relevant models and architectures for urban security monitoring systems based on IoT technologies and artificial neural networks.

Furthermore, a structured scientific protocol was developed to guide this study, ensuring the systematic organization and prioritization of the gathered information. Finally, a qualitative analysis of 45 reviewed studies was conducted to examine the scope and limitations of deep learning models for security monitoring in smart cities, considering technical, ethical, and privacy-related aspects affecting citizens using these systems. This analysis provides a comprehensive perspective on the applicability of these technologies within contemporary urban contexts.

This research is essential for developers, researchers, educators, students, and institutions such as regional governments [20], as it provides critical insights for enhancing security in high-risk and moderate-risk zones through deep learning applications. Additionally, findings from previous studies in this field will serve as a valuable reference for public authorities responsible for citizen safety, offering a foundation for urban planning and the implementation of security systems tailored to specific risk levels. This approach will facilitate the design of customized security strategies, improving protection and operational efficiency across different urban sectors based on empirical evidence.

This paper is structured as follows: Section 2 describes the methodology employed, including a detailed explanation of the scientific search protocol designed and applied. Section 3 presents the results, organizing findings according to the research questions outlined in the methodology. Section 4 discusses the implications of these findings, analyzing their impact on current knowledge and proposing practical applications. Finally, Section 5 presents the conclusions, summarizing key outcomes and suggesting directions for future research.

2. Methodology

Systematic reviews adhere to rigorous methodologies to minimize bias in the selection, publication, and data extraction processes. In this study, the PRISMA framework [18] and the methodology developed by Kitchenham and Charters [19] were employed. PRISMA, originally designed by Page et al. to structure and conduct systematic reviews evaluating the effects of health-related interventions [18], includes checklist items that are applicable across various research domains. Employing the PRISMA methodology ensures that all relevant information is systematically captured. However, it is important to clarify that PRISMA does not prescribe how systematic reviews should be conducted but rather supports their planning and organization. To complement this approach, this study also integrates the methodology of Kitchenham and Charters [19], which provides a structured framework for both conducting and documenting the review process.

The methodology proposed by Kitchenham and Charters was initially developed to guide systematic reviews of empirical evidence in Software Engineering [19], but it can be effectively applied to other engineering disciplines as well. According to their framework, a well-structured literature review follows three key stages. The first stage, planning, involves identifying the necessity of the review, formulating research questions, and establishing a protocol to guide the process. The second stage, execution, consists of locating and selecting relevant primary studies, extracting and analyzing their data, and synthesizing the findings. The final stage, reporting, focuses on compiling the results into a structured document to communicate this study’s conclusions [19]. These stages, along with their corresponding steps, have been further synthesized by Xiao and Watson [21] and are visually represented in Figure 1.

2.1. Sateg 1—Planning the Review

2.1.1. Step 1 Formulating the Problem

This literature review in the context of IoT and deep learning applied to public security was guided by the formulation of six research questions (RQs). Based on these questions, this study identifies and evaluates key technological tools used for incident detection in scenarios involving violence and crime, analyzing their functionality and reliability through specific performance metrics to propose sustainable and effective solutions. The six formulated research questions are as follows:

• RQ1. What are the primary deep learning models that have been applied to detect violence and crime in smart cities?
• RQ2. How have ethical concerns related to privacy been addressed in IoT-based violence and crime detection systems in smart cities?
• RQ3. How have these proposals contributed to addressing different levels of violence?
• RQ4. What is the scope, what are the benefits, and what are the limitations of these proposals in terms of functionality?
• RQ5. What technological tools have been used to implement these proposals?
• RQ6. How reliable have these systems been based on key model evaluation metrics (accuracy, precision, recall, F1-score)?

2.1.2. Step 2 Developing and Validating the Review Protocol

The review of the literature was structured into three key components: search strategy, inclusion criteria, and exclusion criteria. The search strategy defined the search string used and the databases selected, ensuring the identification of high-quality and relevant studies. The inclusion criteria established the essential characteristics that the selected studies needed to meet, while the exclusion criteria delineated those that were not part of the analysis. These components ensured methodological rigor in addressing the RQs.

The search string used included the following terms: ((“deep” AND “learning”) AND (“violence” OR “crime”) AND (“smart” AND “city”) AND (“internet” AND “of” AND “things” OR “iot”)). This query was adapted and applied to the Scopus (1) and Web of Science (2) databases, both recognized for their extensive coverage of high-impact scientific publications.

TITLE-ABS-KEY(deep AND learning) AND TITLE-ABS-KEY(violence OR
crime) AND TITLE-ABS-KEY(smart AND city) AND TITLE-ABS-
KEY(internet AND of AND things OR iot)

(1)

deep learning (Topic) and violence OR crime (Topic) and smart city (Topic)
and internet of things OR lot (Topic)

(2)

The selection of Scopus and Web of Science as the primary databases was based on their widespread recognition as two of the most comprehensive multidisciplinary research sources. Both platforms index a vast number of high-impact, peer-reviewed journals and international conference proceedings, ensuring broad coverage of relevant research. Moreover, their integration with digital libraries such as IEEE Xplore, Springer, Elsevier, ACM, Wiley, and other repositories in engineering and Computer Science ensures access to rigorous and scientifically validated studies, thereby enhancing the reliability and comprehensiveness of the research findings.

Regarding inclusion criteria, studies published between 2010 and 2024, written in English, and presenting practical applications or prototypes related to deep learning and IoT in the context of public security management were considered, provided they offered full-text access. Among the selected studies, those proposing real-world smart city applications and studies with laboratory simulations for monitoring security patterns in both physical environments and IoT-based cyberspace were included. In the latter case, special attention was given to ensuring that the datasets used to train machine learning models were not artificially generated but derived from real-world contexts.

The following exclusion criteria were used to rule out studies:

• Published outside the defined timeframe (2010–2024).
• Written in languages other than English.
• Not directly related to deep learning, IoT, and public security.
• Proposing purely theoretical models without empirical validation.
• Describing only conceptual frameworks for smart city security.

This study aims to quantitatively analyze the effectiveness of deep learning models in monitoring and detecting security patterns in both physical and cyberspace environments where IoT technologies are employed. Therefore, it was crucial for the included studies to provide effectiveness evaluation metrics and the accuracy of the trained neural network model.

2.2. Stage 2—Conducting the Review

2.2.1. Step 3–5 Identification of Relevant Studies (Title, Abstract, and Full Text)

A search conducted in Scopus and Web of Science by experts in scientific databases and bibliometric resource management identified a total of 100 studies, with 62 retrieved from Scopus and 38 from Web of Science (see Figure 2). A detailed list of the retrieved studies from both databases is available in the following repository: https://shorturl.at/5jEM9 (accessed on 8 March 2025). After removing 5 duplicate records, 95 studies remained. The application of exclusion criteria further eliminated 27 studies, reducing the selection to 68 for title analysis. A subsequent abstract review narrowed the selection to 23 studies, and ultimately, 45 studies (32 from Scopus and 13 from Web of Science) were included as the foundation of this analysis.

2.2.2. Step 6 Data Extraction

The review process gathered key metadata from the 45 selected studies on the application of IoT and deep learning in public security, with a focus on violence and crime detection.

Table 1. Selected and analyzed studies.

Id	Year	Country	Information Source	Type of Paper	Quality Metric	Reference
S1	2021	India	Scopus	Chapter	★★★	[22]
S2	2019	China	Scopus	Journal	★★★	[23]
S3	2023	India	Scopus	Conference	★★★	[17]
S4	2020	Australia	Scopus	Conference	★★★	[24]
S5	2024	Turkey	Scopus	Journal	★★★	[25]
S6	2024	China	Scopus	Chapter	★★★	[26]
S7	2023	India	Scopus	Conference	★★★	[27]
S8	2023	Portugal	Scopus	Journal	★★★	[28]
S9	2022	India	Scopus	Conference	★★★	[29]
S10	2024	India	Scopus	Journal	★★★	[30]
S11	2024	India	Scopus	Journal	★★★	[31]
S12	2022	Qatar	Scopus	Journal	★★★	[32]
S13	2024	India	Scopus	Journal	★★★	[33]
S14	2024	Nigeria	Scopus	Journal	★★★	[34]
S15	2021	Saudi Arabia	Scopus	Journal	★★★	[35]
S16	2023	Egypt	Scopus	Journal	★★★	[36]
S17	2024	India	Scopus	Chapter	★★★	[37]
S18	2023	Taiwan	Scopus	Journal	★★★	[38]
S19	2021	Brazil	Scopus	Conference	★★★	[39]
S20	2023	China	Scopus	Chapter	★★★	[40]
S21	2024	Pakistan	Scopus	Conference	★★★	[41]
S22	2023	Saudi Arabia	Scopus	Journal	★★★	[42]
S23	2021	Pakistan	Web of Science	Journal	★★★	[43]
S24	2024	India	Scopus	Journal	★★★	[44]
S25	2022	India	Scopus	Conference	★★★	[45]
S26	2019	India	Scopus	Journal	★★★★	[46]
S27	2024	India	Scopus	Journal	★★★	[47]
S28	2023	South Korea	Scopus	Conference	★★★★	[48]
S29	2022	India	Scopus	Journal	★★	[49]
S30	2022	France	Scopus	Conference	★★★	[50]
S31	2021	India	Scopus	Conference	★★	[51]
S32	2020	Morocco	Scopus	Conference	★★★	[52]
S33	2023	India	Scopus	Conference	★★★	[31]
S34	2022	Saudi Arabia	Web of Science	Journal	★★★	[53]
S35	2021	Australia	Web of Science	Journal	★★★	[54]
S36	2024	Morocco	Web of Science	Journal	★★★	[55]
S37	2022	India	Web of Science	Journal	★★	[56]
S38	2023	Saudi Arabia	Web of Science	Journal	★★★	[57]
S39	2023	India	Web of Science	Journal	★★★	[58]
S40	2023	Morocco	Web of Science	Journal	★★★	[59]
S41	2023	Egypt	Web of Science	Journal	★★★	[60]
S42	2021	India	Web of Science	Journal	★★★★	[61]
S43	2024	China	Web of Science	Journal	★★★	[62]
S44	2023	USA	Web of Science	Journal	★★	[63]
S45	2023	Pakistan	Web of Science	Journal	★★★★	[64]

★★ Level 1 + simulation/experimentation; ★★★ Level 2 + performance evaluation of the deep learning model based on accuracy, precision, recall, or F1-score; ★★★★ Level 3 + application in a real-world scenario.

presents data from the analyzed articles, including publications in scientific journals, book chapters, and conference proceedings, incorporating diverse perspectives and experiences from researchers across different levels of complexity.

In addition to applying the previously described inclusion and exclusion criteria, a quality evaluation method was implemented before selecting the studies. The star-based evaluation method, a simple feedback system that uses stars to represent the quality of content—such as scientific articles—was employed to determine which studies would be analyzed in the systematic literature review. The results of this evaluation process are presented in column “quality metric” of Table 1.

This evaluation method ensured the selection of studies that were closely aligned with the research topic and is structured as follows:

• Level 1 (★): Studies integrating IoT and deep learning;
• Level 2 (★★): Level 1 + simulation/experimentation;
• Level 3 (★★★): Level 2 + performance evaluation of the deep learning model based on accuracy, precision, recall, or F1-score;
• Level 4 (★★★★): Level 3 + application in a real-world scenario;
• Level 5 (★★★★★): Level 4 + graphical evidence of pattern recognition in a real city.

2.2.3. Step 7 Analyzing and Synthesizing Data

The analysis of the graph in Figure 3 reveals a significant increase in scientific output on the application of IoT and deep learning in public security, particularly in the context of violence and crime, between 2019 and 2024. Research in this field has been primarily concentrated between 2021 and 2024, with a peak in 2023, reaching 16 publications.

During the early years (2019–2020), scientific production was limited, reflecting an initial exploratory phase. The subsequent sustained growth suggests that these technologies have become key tools to address security challenges. Although 2024 shows a slight decline, the publication volume remains significant, reinforcing the consolidation of this research area as a priority at the intersection of technology and security.

On the other hand, as illustrated in Figure 4, research on this subject has been predominantly concentrated in India, which accounts for 18 studies (40%), followed by China and Saudi Arabia, each contributing 4 studies (9%).

India has emerged as a global leader in the research and application of IoT and deep learning for urban security, driven by a robust technological ecosystem, collaborative synergy between academia, government, and industry, and government-backed initiatives such as the Smart Cities Mission [65]. In contrast, China’s significant role in this field is rooted in its state-driven adoption of advanced video surveillance, facial recognition, and behavioral analysis technologies, which are integral to its national security and social control strategy. Large-scale programs such as the Skynet Project [66] have positioned China as the country with the world’s most extensive video surveillance system, leveraging millions of interconnected cameras, AI algorithms, and IoT networks to enhance monitoring capabilities.

Additionally, Morocco and Pakistan each contributed 3 studies (7%), while Egypt and Australia contributed 2 studies (4%) each. These contributions highlight a growing global interest in the integration of IoT and deep learning for urban security, extending beyond the dominant research hubs of India and China.

Beyond these countries, other nations actively involved in advancing this field include Brazil, France, Nigeria, Portugal, Qatar, Russia, South Korea, Taiwan, Turkey, and the United States. These contributions reflect the increasing adoption of smart city technologies worldwide, driven by regional security challenges, technological advancements, and government-backed initiatives.

2.3. Sateg 3—Reporting the Review

Step 8 Reporting Findings

A comprehensive report of the review’s findings is presented in Section 3. The results of the systematic review are structured to directly address each of the previously formulated research questions. To facilitate this, key information has been condensed into tables, enabling a clear and structured representation of essential aspects.

3. Results

The results provide precise answers to the six research questions, highlighting how the integration of disruptive technologies enhances surveillance and protection in urban environments through physical infrastructure and communication networks, which are essential for smart city service management.

3.1. RQ1—What Are the Primary Deep Learning Models That Have Been Applied to Detect Violence and Crime in Smart Cities?

Several studies have proposed models for IoT security, intrusion detection, and urban surveillance, facilitating the identification of threats such as violent incidents, cyberattacks, and unauthorized access. The results summarized in

Table 2. Deep learning models used for the development of violence and crime detection in IoT scenarios.

Id	Proposal	Deep Learning Model Used	Used Dataset	Detected Violence Actions	Detected Crime Actions
S1	Detection of terrorist activities on social media	CNN (Convolutional Neural Networks)	Images and videos of social media	Identification of criminal activities through images and videos on social media	Alert system for human operators to take immediate action
S2	Intrusion detection	Deep Migration Learning Model (DMLM)	KDD CUP 99	N/A	N/A
S3	Real-time intrusion detection	CNN-LSTM (Long Short-Term Memory)	Bot-IoT, IoTID20	DDoS (Distributed Denial of Service), Flood, Botnet attacks	N/A
S4	Cyberattack detection	Artificial Neural Network (ANN)	UNSW NB15	IoT attacks, unauthorized access, botnet	N/A
S5	Energy theft detection	CNN	Real and synthetic data	N/A	Detection of cyberattacks on smart meters
S6	Intrusion detection	LSTM-CNN	KDDCup99	N/A	Cybercrime (malicious flow)
S7	Host intrusion detection for IoT	O-CNN (Optimized CNN)	BoT-IoT	N/A	Cybercrime: DDoS, data exfiltration, key logging
S8	Intrusion detection system (IDS)	Deep Neural Network (DNN)	IoT-23 y MQTT-IoT-IDS2020	N/A	Anomaly detection and attacks in IoT device networks
S9	DDoS detection	DNN with Hyperparametrization	CICDDoS 2019 dataset	N/A	Cyberattacks (DDoS, including TCP Syn, UDP flood, and ICMP attacks)
S10	Attack detection in IoT	Deep Belief Networks (DBNs) + CNN	UNSW-NB15	N/A	Property crimes
S11	Intrusion detection	DNN, Extreme Gradient Boosting (XGBoost)	UNSWNB15	N/A	Detects network intrusions, including DoS (Denial of Service), DDoS, and malicious IoT activities
S12	IDS	Multi-Layer Perceptron (MLP)	BlueTack dataset	N/A	Cybercrime
S13	Surveillance of smart homes	Yolo7 with transfer learning	Roboflow datasets	Street violence	Property crimes, personal crimes
S14	IoT-Defender	Genetic Algorithm (GA)-LSTM	UNSW-NB15	N/A	Cybercrime
S15	IDS	GRU (Gated Recurrent Unit)	Data of CPS	N/A	DoS attacks
S16	Self-adaptive traffic identification intrusion detection system	LSTM	ToN-IoT, InSDN	N/A	DoS/DDoS attacks, XSS (Cross-Site Scripting), BFA (Brute Force Attack), MitM, Backdoor, Probe, Web
S17	IDS	X-DeepID (Hybrid CNN-LSTM)	ToN-IoT	N/A	Enhances intrusion detection in IoT
S18	Lightweight meta-learning BotNet attack detection	Meta-Learning Ensemble (Super Learner, Subsemble, Sequential Learner)	KDD99	N/A	Botnet traffic detection and cyberattacks in IoT categorized as malicious network flows
S19	IoT-based IDS with Deep Learning	CNN-RNN-LSTM, DNN, LSTM	MQTT-IoT-IDS2020	N/A	Message Queuing Telemetry Transport (MQTT) attacks: aggressive scanning, UDP scanning, brute force in SSH and MQTT
S20	Attack detection in IoT network traffic	CNN optimized with SE-Net and Capsule Networks	Network traffic	N/A	DDoS attacks, Botnets, network traffic anomalies
S21	Intrusion detection in smart cities	Gradient Boosting	IoTID20	N/A	DoS/DDoS attacks, ransomware, port scanning, Man-in-the-Middle (MITM) attacks, malware, injection attacks
S22	Cyberattack detection	Cascaded Adaptive Neuro-Fuzzy Inference System (CANFIS) + Modified Deep Reinforcement Learning (MDRL)	ISCX 2012 IDS, IoT network intrusion	N/A	Botnet malware attacks (Mirai), UDP Flooding, SMTP spam
S23	Decision support system for facial sketch synthesis	Spiral-Net (Spiral Neural Network), SNET (Spiking Neural Network-based Intrusion Detection System)	CUFS, CUFSF, IIT photo-sketch dataset	Identification of suspects through sketches, facial recognition for forensic support	N/A
S24	IDS	GA-CNN	MQTT-IoT-IDS2020	N/A	DDoS, injection, ransomware
S25	IDS	DHLNN optimized with HCSGA (Hybrid Chicken Swarm Genetic Algorithm)	NSL-KDD	N/A	IoT network intrusions
S26	Smart urban management system	CNN	Images of CCTV	Detection of weapons (guns)	N/A
S27	IoT intrusion detection	Hybrid CNN-BILSTM with Transfer Learning	N_BaIoT (data of attacks botnet).	N/A	Detection and classification of Mirai and BASHLITE attacks
S28	Violence detection in industrial surveillance videos using IoT	CNN, LSTM, GRU	Hockey fight dataset	Fights, use of knives or firearms	N/A
S29	IoT-based smart security system for homes	Single-Shot MultiBox Detector (SSD)	Common Objects in Context (COCO)	Unauthorized intrusion; detection of suspicious tools	Theft; unauthorized access to residential properties
S30	Intrusion detection using explainable artificial intelligence (XAI)	DNN	NSL-KDD	N/A	DDoS, Probe, Backdoors, Fuzzers
S31	Multi-cloud intrusion detection system (MCIDS)	CNN	UNSW-NB15	N/A	Unauthorized access, data theft, and privacy invasion
S32	Intrusion detection	DNN	CICDDoS2019	N/A	DDoS attacks
S33	Electricity theft detection	Stacked CNN + Random Forest	Electricity theft	N/A	Electricity theft
S34	Intrusion detection system	Voting Classifier	ToN-IoT telemetry	N/A	Attacks like DDoS, ransomware, XSS, etc.
S35	Detection of DDoS and Replay attacks	Hybrid (Restricted Boltzmann Machin (RBM) + CNN)	Smart soil	N/A	DDoS, Replay
S36	Intrusion detection in IoT	LSTM	Edge-IIoT	N/A	DDoS, SQL injection, ransomware
S37	Attack detection in IoT	Hybrid (CNN + DBN)	N/A	N/A	DDoS attacks, ransomware, SQL injections
S38	Hybrid deep learning for detection and classification of malicious URLs	Stacked Autoencoder (SAE) and BiLSTM (Bidirectional LSTM)	Malicious URLs	Not applicable (focused on detection of malicious URLs)	Phishing, malware, defacement
S39	Hybrid deep learning with Blockchain and IoT for smart city security	Hybrid LSTM-Support Vector Machine (SVM)	UNSW-NB15	Not applicable (cyberattacks)	Cyberattacks: DoS, fuzzers, exploits, reconnaissance
S40	Detection of routing protocol for low-power lossy networks (RPL) version number attacks in IoT	LSTM	Simulated Dataset with Cooja Simulator	Not applicable (cyberattacks)	Manipulation of Destination Oriented Direct Acyclic Graph Information Object (DIO) messages, increased latency
S41	Hierarchical intrusion detection system	LSTM based on Recurrent Neural Network (RNN)	ToN-IoT	N/A	Various cyberattacks
S42	Label health systems in mass protests	CNN	Curated protest dataset and violence data extracted from YouTube	Protests turned violent: assaults, severe disturbances	Arson, object throwing, clashes with security forces
S43	Advanced security framework for edge computing in smart cities	Extreme Learning Machines (ELMs) + Replicator Neural Networks + Deep Reinforcement Learning–Deep Q-Network (DRL-DQN)	CICIDS2017	N/A	Distributed Denial of Service (DDoS) attacks
S44	Adversarial attacks on DRL-based traffic signal control systems	DRL, Proximal Policy Optimization (PPO)	Simulated traffic data based on Monaco	Vehicle collusion to alter signaling times	Traffic data manipulation to falsify conditions
S45	Violence detection in surveillance videos	CNN + LSTM	Hockey fights	Fist fights, abuse with non-projectile weapons	N/A

N/A = Not Available.

highlight the key characteristics of each proposal, emphasizing the neural networks trained to manage violence and crime in smart city environments. Most studies also provide details on the datasets used to train and test these models.

The detection of cyberattacks and threats in IoT environments has led to the development of diverse deep learning models designed to identify anomalous patterns and sophisticated attacks. Among these, Convolutional Neural Networks (CNNs) have been widely employed due to their capability to extract spatial features efficiently and classify network traffic anomalies. This trend is evident in S1, S5, S7, S10, S19, S20, S24, S26, S28, and S42 where CNN-based models are used for intrusion detection, DDoS attack mitigation, and cybercrime analysis in smart cities and IoT-based infrastructures. In these studies, CNNs have been deployed both individually and in combination with other architectures, improving the accuracy and generalization of cybersecurity systems.

Additionally, hybrid CNN-LSTM architectures have demonstrated remarkable efficiency in intrusion detection and threat classification, as they enable the extraction of both spatial and temporal attack characteristics. Studies such as S3, S6, S17, and S45, highlight this approach, where CNNs classify malicious activities while LSTM networks capture sequential attack behaviors. For instance, S6 applies LSTM for temporal pattern analysis, while CNNs extract spatial features. This combination strengthens real-time threat detection and improves incident response in IoT security infrastructures.

Beyond conventional deep learning models, Deep Reinforcement Learning (DRL) and adversarial learning techniques have been integrated to enhance cybersecurity defenses dynamically. Notably, S5, S7, S18, S22, S43, and S44 incorporate DRL-based approaches that optimize real-time decision-making to counteract cyberattacks adaptively. For example, S18 and S22 implement DRL to improve network intrusion detection systems (NIDSs) and firewall protection for IoT access points, while S44 explores adversarial attacks against Automated Traffic Control Systems (ATCSs), evaluating their resilience against security breaches.

Meanwhile, alternative deep learning methodologies such as YOLO + ResNet-50 (S13) and SSD with MobileNet (S29) have been leveraged for real-time security event detection. These models, primarily used in surveillance and object recognition, provide enhanced precision in detecting threats in urban and IoT-based monitoring environments. Such vision-based AI models contribute to cyber-physical security, integrating image analysis with anomaly detection to prevent cyber and physical threats in smart infrastructures.

Finally, genetic algorithms (GAs) have been integrated into cybersecurity frameworks to enhance feature selection, optimize hyperparameters, and improve intrusion detection efficiency. Notably, S14, S23, S24, and S25 incorporate GA-based approaches that refine deep learning models by reducing dimensionality and enhancing classification accuracy in IoT security applications. For example, S14, S24, and S25 utilize GAs to optimize feature selection in intrusion detection systems (IDSs), significantly improving attack classification accuracy and reducing computational overhead. Meanwhile, S24 employs GAs in hybrid intrusion detection models, demonstrating their efficacy in detecting DDoS and botnet attacks in real-time network traffic. These studies highlight the potential of evolutionary algorithms in deep learning-driven cybersecurity, ensuring scalable and adaptive protection against emerging threats in IoT and smart city infrastructures.

3.2. RQ2—How Have Ethical Concerns Related to Privacy Been Addressed in IoT-Based Violence and Crime Detection Systems in Smart Cities?

In the realm of data protection and privacy, studies emphasize the implementation of advanced security mechanisms, including encryption, data anonymization, and privacy-preserving techniques. These measures are particularly critical in IoT and smart city ecosystems, where the vast volume of collected data poses significant security and privacy risks. Notably, S3 and S21 illustrate how normalization techniques and null-value removal enhance system accuracy while minimizing risks associated with sensitive data handling. Additionally, S20, S23, and S25 explore privacy-preserving mechanisms such as differential privacy and federated learning, ensuring data protection without compromising model effectiveness. Moreover, S27 addresses data anonymization and user consent management, aligning with global privacy regulations to enhance compliance and transparency.

Regarding cybersecurity, studies extensively address intrusion detection and real-time network traffic analysis. Specifically, S9, S12, S16, S20, S21, S23, S30, S32, S34, S35, S36, and S43 highlight the importance of implementing proactive defense mechanisms against DDoS attacks and botnets, leveraging AI-driven monitoring systems to detect and mitigate threats before they impact critical infrastructures. Additionally, S19 and S22 focus on minimizing false positives in cyberattack detection and optimizing system efficiency by improving anomaly classification. Meanwhile, S16, S18, and S27 explore behavioral analysis models to refine cybersecurity defenses and enhance the reliability of IoT-based security systems.

In the domain of public security and surveillance, studies focused on enhancing real-time security through edge processing for video analysis, early detection of violent incidents, and automated alert generation. Specifically, S26 and S28 implement lightweight deep learning models to process video feeds at the edge, enabling rapid detection of violent activities while reducing reliance on centralized cloud systems. S42 introduces AI-powered motion recognition techniques for the early detection of aggressive behavior, improving response times in high-risk areas. Additionally, studies S26, S42, and S45 develop AI-driven automated alert systems that trigger security notifications upon detecting potential threats, while S28 and S23 emphasize the integration of these systems with existing surveillance networks to ensure seamless operation. Furthermore, S42 extends the application of public surveillance by integrating health risk assessment mechanisms, using AI to detect distress symptoms and abnormal behaviors that may indicate medical emergencies.

Finally, addressing ethical considerations and regulatory compliance, studies examine the trade-off between privacy and security, algorithmic transparency, and adherence to legal frameworks for data protection. Specifically, S2 and S15 propose privacy-preserving security models that integrate encryption, anonymization, and federated learning to minimize data exposure risks while maintaining security effectiveness. Studies S13, S28, S45, and S23 assess the ethical implications of surveillance technologies, highlighting concerns over civil liberties and proposing responsible AI governance strategies. Compliance with data protection studies in which surveillance systems are proposed should explore informed consent mechanisms, data governance strategies, and privacy-by-design principles to align IoT security infrastructures with legal and ethical standards.

3.3. RQ3—How Have These Proposals Contributed to Addressing Different Levels of Violence?

One way to classify criminal events in smart cities is based on their severity. Minor crimes, such as theft and vandalism, are typically non-violent but still disruptive, as they do not usually cause significant physical harm to victims. At an intermediate level, violent crimes, including assaults and armed robberies, pose a higher risk to physical integrity. Finally, severe crimes, such as homicides, kidnappings, and organized violence, represent the most serious threats to citizen safety. This classification, detailed in Figure 5, serves as the basis for analyzing the IoT and deep learning proposals in this study, specifically regarding their role in detecting violent actions and crimes that negatively impact public safety. In addressing this research question, only physical crimes occurring in real-world environments, such as streets, tourist sites, and homes, are considered, excluding cyberattacks or cybercrimes.

3.3.1. Monitoring Violence Actions

The citizen security taxonomy in Figure 5 classifies violence actions and crimes based on their nature and severity, providing a hierarchical and structured view of these phenomena. Violence actions are diverse; however, for the purposes of this study, five types of violence are considered: domestic violence, gender-based violence [67], child and adolescent violence, sexual violence [68], and street violence actions (such as vandalism). Each of these actions can cause physical and/or psychological harm to individuals or groups, either directly or indirectly.

Among the analyzed studies, three main studies (e.g., S28, S42, S45) focused on monitoring street violence. These studies addressed vandalism and public disturbances, tracking their occurrence and severity in urban areas. They utilized image processing, video surveillance, and real-time monitoring to detect violent incidents in public spaces, emphasizing the identification of public disturbances and confrontations, which contribute to enhancing public safety and enabling timely interventions.

The analyzed proposals apply deep learning to enhance urban security through artificial intelligence (AI) and data analytics. Generic and hybrid CNNs are commonly used to improve crime detection accuracy. For example, property crime detection is explored in S5, S13, and S33, focusing on electricity theft and unauthorized property intrusion, demonstrating how technology aids crime prevention. Additionally, several studies highlight the integration of deep learning and IoT in urban security, illustrating the diversity of threats and the technological solutions employed.

Physical violence in public spaces is analyzed in various studies, focusing on automatic detection of assaults and weapons (e.g., S28, S26) and urban disturbances with intelligent classification of critical events (e.g., S42). Other studies highlight intruder identification and hazardous object detection in restricted areas (e.g., S29).

3.3.2. Monitoring of Crime

Crime encompasses a broad spectrum of offenses, ranging from property crimes (e.g., S5, S33), such as theft and vandalism, to crimes affecting physical integrity (e.g., S26, S28, S42, S45), including homicides and kidnappings. This category also includes drug possession and trafficking (not reported in the analyzed studies), financial fraud (e.g., S38, S39), and cybercrime, which occurs within computer systems and cyberspace (e.g., S1, S2, S3, S4, S6, S7, S8, S9, S12, S14, S15, S16, S17, S18, S19, S20, S21, S22, S23, S24, S25, S27, S29, S30, S31, S32, S33, S34, S35, S36, S37, S38, S39, S40, S41, S43, S44, S45). Cybercrime-related threats include intrusions and attacks. Although drug trafficking is not explicitly addressed in the reviewed studies, its connection to cybercriminal networks highlights the need for broader digital security strategies.

In the realm of cybersecurity, research trends indicate a strong emphasis on intrusion detection and cyberattack prevention, particularly in IoT networks (e.g., S2, S3, S7, S11, S14, S19, S21, S27, S34). Several studies propose anomaly detection methods to identify threats such as DDoS attacks, botnets, and IoT-targeted crimes using hybrid or specialized deep learning models. Additionally, various proposals explore strategies for detecting and mitigating complex cyberattacks, including ransomware, SQL injections, and DoS attacks.

Furthermore, other studies focus on cyberattack and cybercrime detection, particularly in malware identification (e.g., S4, S12, S17), unauthorized access (e.g., S4, S10, S15, S17), and data manipulation (e.g., S4, S12, S20). Most research prioritizes cyberattack prevention, with an emphasis on DDoS mitigation, ransomware threats, botnet detection, and data privacy concerns. Some specialized approaches, such as S22, S27, S32, and S40, specifically address cyber threats like flooding attacks and traffic manipulation in IoT environment

3.4. RQ4—What Is the Scope, What Are the Benefits, and What Are the Limitations of These Proposals in Terms of Functionality?

Table 3. Scope, benefits, limitations, and technical aspects of the analyzed proposals.

Id	Scope	Testing Context	Implementation Feasibility	Code Availability	Benefits	Technical Limitations
S1	Detection of terrorist activities in social networks and prediction of attacks	Simulation	High	No	Improved monitoring of online activities	Complexity in unstructured data analysis
S2	Real-time analysis platform to increase security in IoT networks	Simulation	Moderate	No	Improvement in intrusion detection	Limitations in the processing capacity of the nodes
S3	Real-time detection of intrusions and threats in IoT networks	Simulation	Moderate	Partial	High accuracy and lower false positive rate	Limited resources in IoT
S4	Intrusion and anomaly detection to increase the security of smart city applications	Simulation	Moderate	No	Early identification of IoT attacks	Limitations on IoT resources
S5	Malicious consumption detection for fraud classification	Simulation	Moderate	Yes	Increased detection of fraudulent consumption	Possible overfitting in real data
S6	Intrusion detection	Simulation	Moderate	Yes	High detection accuracy	Dependence on training data
S7	Intrusion detection	Simulation	Moderate	Yes	Improvement in the security of IoT devices	Optimize for data quality and resource-constrained devices
S8	Detection of anomalies in IoT network traffic to protect against cyber attacks	Simulation	Moderate	Yes	Improvement in the security of IoT networks and early detection of attacks	Limited resources on IoT devices can affect performance
S9	Detection of DDoS for improving security	Simulation	Moderate	No	High accuracy in detecting DDoS attacks	Need for optimization to avoid high execution times on large volumes of data
S10	IoT attack detection system	Simulation	Moderate	Yes	Improved incident response	Requires advanced infrastructure
S11	Network intrusion detection to improve data protection and network security	Simulation	Moderate	Yes	High detection accuracy, reduction in false positives	Complex IDS configuration
S12	Intrusion detection to improve medical data protection	Simulation	Moderate	No	Improvement in data security	Limitations in processing capacity
S13	Threat detection to increase security	Simulation	Moderate	Yes	Reduction in false positives	Dependence on data quality
S14	Intrusion detection for improving the security in IoT	Simulation/Real	Moderate	Yes	Quickly identify attacks	Limited resources on edge devices
S15	Intrusion detection for improving the security in cyber-physical systems	Simulation	Moderate	No	High detection accuracy	Attack data dependency. Computational complexity
S16	Intrusion detection for improving the security in IoT	Simulation	Moderate	Yes	Improved attack detection	Dependency on quality data
S17	Intrusion detection for improving the security in IoT	Simulation	Moderate	Yes	Improvement in attack detection	Complexity in implementation
S18	Detection of botnets in IoT network traffic	Real	Moderate	No	Protection of IoT devices without the need for expensive infrastructure	Training data dependency
S19	Detection of MQTT attacks in IoT networks	Simulation	Moderate	Yes	High precision in detecting intrusions in IoT networks	Requires preprocessing and data balancing
S20	Detection and classification of intrusions to increase protection against cyberattacks	Simulation	Moderate	Yes	Improved network security	Configuration complexity
S21	Detection and classification of intrusions to increase protection against cyberattacks	Simulation	Moderate	No	Improvement in intrusion detection	Challenges in data management
S22	Detection and isolation of attacks to improve the security of IoT devices	Simulation	Moderate	No	High precision in detection	Dataset-dependent, captures specific attacks
S23	Automatic synthesis of facial sketches improving forensic identification and reducing recognition errors	Real	Moderate	No	Improved facial identification accuracy	Limited datasets, difficulty in fine facial details
S24	Intrusion detection for improving the security of systems	Simulation	Moderate	Yes	Improved detection	Data dependency
S25	Intrusion detection for improving the security of systems	Simulation	Moderate	No	Improved detection	Susceptibility to data characteristics
S26	Weapons detection, waste management, and traffic control to improve public safety	Real	Moderate	Yes	Improved security	Dependence on data quality
S27	Efficient detection of botnet attacks in IoT	Simulation	N/A	No	High precision and robust attack classification	Requires significant computational resources
S28	Automatic violence detection	Simulation	N/A	No	Improved security and reduction in manual efforts	Dependence on video quality and IoT connectivity
S29	Automatic object detection and classification	Real	N/A	No	Improved security and real-time alerts	Problems with images in low lighting conditions
S30	Intrusion detection	Simulation	Moderate	Yes	Reliability	Dependency on quality data
S31	Intrusion detection for improving the security in IoT	Simulation	Moderate	No	Improved detection	Dependency on quality data
S32	Attack detection for improving the security in IoT	Simulation	Moderate	No	Improved attack detection	Dependency on quality data
S33	Detection of electricity theft in smart networks	Simulation	Moderate	No	Reduction in financial losses	Risk of overfitting and data limitation
S34	Identification and prevention of intrusions in IoT networks	Simulation	Moderate	No	High precision in threat detection	Dependency on high computing resources
S35	Identification of DDoS attacks in smart environments	Simulation	Moderate	No	High precision and time-efficient	Complexity when modeling temporal dependencies
S36	Intrusion detection and improving security in IoT	Simulation	Moderate	No	Improved security with high precision	Processing dependence on advanced hardware
S37	Intrusion detection and improving security in IoT	Simulation	Moderate	No	High accuracy in threat identification	Complexity in hyperparameter optimization processes
S38	Automatic classification and detection of malicious URLs	Simulation	Complex	No	High precision, efficient detection of cyber threats	High dependence on computational resources
S39	Attack classification and secure environment management for IoT transactions	Simulation	Complex	No	High precision, safety improvement	Requires high computing power
S40	Identification and mitigation of Routing Protocol for Low-Power and Lossy Networks (RPL) attacks	Simulation	Complex	No	Security improvement, threat mitigation	Reliance on extensive simulations
S41	Accurate detection of anomalies in IoT traffic to protect the system from cyber attacks	Simulation	Complex	No	Improved security and optimization of energy consumption	Requires specific data for training
S42	Protest classification and severity labeling	Simulation	Complex	No	Faster response in emergencies	Visual data dependency; risk of model overfitting
S43	Anomaly detection and improved incident response	Simulation	Moderate	No	Increase in security	Dependency on precise data
S44	Adaptive traffic control resistant to adversarial attacks	Simulation	Moderate	No	Reduction in waiting time in false collisions	Reliance on accurate data and risks of bias in models
S45	Violence detection in digital videos	Simulation	Moderate	No	Improvement in the detection of violence	Training data dependency

N/A = Not Available.

demonstrates that IoT and deep learning-based solutions, primarily tested in simulations or laboratory experiments (41 studies, 91%), exhibit high scalability and accuracy in threat detection, significantly enhancing urban security. However, their implementation faces challenges such as dependence on advanced infrastructures, data quality issues, and configuration complexity. While some approaches offer moderate costs and provide accessible code on repositories such as GitHub, others require high computational resources, limiting their widespread adoption.

3.4.1. Implementation Technical Aspects

The analyzed proposals exhibit high scalability, indicating their potential for deployment in complex urban environments. However, some solutions (e.g., S2, S3, S4, S7, S8, S10, S15, S27, S34, S36, S38, S39) face limitations due to high computational requirements, restricting their feasibility in resource-constrained settings. Despite these challenges, most intrusion detection, cyberattack prevention, and physical threat monitoring systems demonstrate feasibility for integration into urban infrastructures, provided that implementation and processing requirements are optimized.

Regarding implementation feasibility, most analyzed solutions present moderate complexity, requiring specialized configurations and appropriate infrastructure. Their integration into urban environments remains feasible with proper technical planning. However, some proposals (e.g., S38–S42) pose greater challenges due to the need for high-performance computational processing and complex algorithmic models. Furthermore, certain solutions (e.g., S27–S29) do not specify this aspect, raising concerns about practical feasibility.

Code availability is another critical factor in implementing these solutions. While some studies (e.g., S5, S6, S7, S8, S10, S11, S14, S16, S19, S20, S25, S26, S30) provide access to source code, facilitating validation and continuous improvement, a significant majority (e.g., S1–S4, S9, S12, S15, S18, S21, S23, S24, S27–S45) do not, limiting transparency and customization potential. The lack of open-source code hinders scientific collaboration and the development of more robust and scalable solutions, restricting their integration into diverse urban infrastructures.

The implementation cost of these solutions varies significantly depending on system complexity and resource requirements. Most studies do not specify implementation costs, leading to uncertainty regarding the investment required for large-scale deployment and the long-term sustainability of these solutions within urban security infrastructures. This may be attributed to the fact that 91% of the proposals were tested only in experimental settings and not in real-world urban environments. Only studies S18, S26, S29, and S23 were tested in real scenarios. S26 used real-life CCTV images, while S45 employed real-life violence situations and hockey fight datasets to assess model performance. These real-world tests, although limited, provide valuable insights into how well the models perform under conditions resembling those in actual smart city environments.

The analyzed proposals exhibit high scalability, indicating their potential for deployment in complex urban environments. However, some solutions (e.g., S2, S3, S4, S7, S8, S10, S15, S27, S34, S36, S38, S39) face limitations due to high computational requirements, restricting their feasibility in resource-constrained settings. Additionally, certain proposals do not specify their scalability, introducing uncertainty regarding their large-scale applicability. Despite these challenges, most intrusion detection, cyberattack prevention, and physical threat monitoring systems demonstrate feasibility for integration into urban infrastructures, provided that implementation and processing requirements are optimized.

Regarding the ease of implementation, most analyzed solutions present moderate complexity, requiring specialized configurations and appropriate infrastructure. Their integration into urban environments remains feasible with proper technical planning. However, some proposals (e.g., S38–S42) pose greater challenges due to the need for high-performance computational processing and complex algorithmic models. Furthermore, certain solutions (S27–S29) do not specify this aspect, raising concerns about practical feasibility.

3.4.2. Benefits and Technical Limitations

Among the key benefits, real-time monitoring (e.g., S1) enables the continuous surveillance of social media environments, facilitating the rapid identification of suspicious activities such as terrorism. Early attack detection (e.g., S4, S8, S10, S19, S21, S22, S27, S35, S44) has strengthened intrusion prevention and improved the resilience of critical infrastructures in smart cities. Additionally, enhanced cybersecurity in IoT networks (e.g., S3, S11, S14, S16, S17, S22, S23, S31, S36, S37, S39) has mitigated vulnerabilities in connected devices, reducing the risk of cyberattacks and unauthorized access.

Another advantage of these technologies is their ability to automate the classification of critical events, streamlining incident prioritization and improving response efficiency for security agencies. Advanced fraud and theft detection (e.g., S5, S33) has been achieved through the integration of artificial intelligence models capable of analyzing behavioral patterns and predicting crimes in high-risk areas. Furthermore, the combination of IoT and deep learning has optimized security resource management, minimizing operational costs and expanding coverage in densely populated urban areas.

Despite these advantages, significant challenges remain. One major limitation is the dependency on the data used to train models, which can impact their generalization and effectiveness in real-world scenarios (e.g., S6, S13, S15, S16, S18, S24, S26, S30, S31, S32, S43, S45). Another limitation relates to the high computational requirements of these systems (e.g., S27, S38, S39), which hinder their adoption in resource-constrained environments. Many solutions require specialized hardware, such as high-performance GPUs, increasing implementation costs and restricting their use in budget-limited security infrastructures. Additionally, optimizing large-scale data processing (e.g., S9) remains a challenge, as urban surveillance systems generate massive data streams that must be processed in real time without compromising latency or operational efficiency.

The configuration of intrusion detection systems (e.g., S11, S20) is another critical factor, requiring continuous adjustments to minimize false alarms and ensure accurate threat detection in IoT networks. Moreover, bias in artificial intelligence models (e.g., S44) can lead to discriminatory behavior in suspect identification, raising ethical and legal concerns regarding the application of these technologies

3.5. RQ5—What Technological Tools Have Been Used to Implement These Proposals?

The combination of software and hardware tools presented in

Table 4. Software and hardware used to implement the analyzed proposals.

Category of Tools	Tools and Studies Which Applied Them
Programming languages	Python: S1, S2, S3, S4, S5, S6, S7, S8, S9, S10, S11, S12, S13, S14, S15, S16, S17, S18, S19, S20, S21, S24, S26, S27, S28, S29, S30, S31, S32, S33, S34, S35, S36, S37, S38, S39, S40, S41, S42, S43, S44, S45, S23; Java: S25; Matlab: S22
Frameworks	TensorFlow: S1, S3, S5, S8, S9, S10, S11, S12, S13, S19, S20, S21, S23, S24, S27, S28, S29, S31, S32, S33, S34, S35, S36, S37, S43, S44, S45; Keras: S1, S3, S4, S5, S6, S10, S11, S13, S19, S21, S23, S24, S25, S27, S41; PyTorch: S11, S44; Scikit-learn: S3, S4, S5, S11, S12, S13, S16, S18, S19, S21
Hardware	GPU: S1, S3, S5, S10, S19, S42, S35; CPU: S3, S4, S5, S13, S35; Raspberry Pi: S14, S18, S26; Intel Core i7: S3, S16, S21, S23, S33; Intel Core i5: S4, S23, S41, S44; Raspberry Pi: S14, S18, S26; NVIDIA: S10, S39, S42, S45, S23; Cloud based server: S23, S44; Google Collaboratory: S18
Complementary tools	Numpy (S4, S11, S29); Pandas (S4, S11, S12); Scikit-learn (S3, S4); Wireshark (S10, S16, S40); tcpdump (S6, S14); Roboflow (S13); SHAP, LIME, RuleFit (S30); SMOTE (S21, S34); Flask (S26); GridSearchCV (S19); Zeek/Bro IDS (S18); BoT-IoT dataset (S7); SUMO (S44); Autoencoder (S36); FastText (S38); OpenCV, Matplotlib (S45); PyCharm (CE); OpenCV (S13, S29); Dask (S19)

reflects a clear trend toward continuous enhancement of deep learning model capabilities. Through the integration of complementary platforms and advanced computing infrastructures, researchers can address increasingly complex challenges, expanding the range of applications across various technological domains. These tools significantly improve the efficiency and adaptability of deep learning models in the analyzed proposals.

The tools used in the analyzed proposals highlight a comprehensive integration of software and hardware, enabling enhanced deep learning models across multiple technological applications. Python emerged as the most widely used programming language, adopted in nearly all studies, except S25, which utilized Java, and S22, where Matlab was employed for specialized simulations. TensorFlow and Keras were the most prominent deep learning frameworks, applied in studies such as S1, S3, S5, and S9, demonstrating their robustness in model development. Meanwhile, PyTorch was used in S11 and S44, emphasizing its flexibility in dynamic graph computation. Scikit-learn played a crucial role in machine learning tasks across various studies, including S3, S4, and S5.

Regarding hardware, GPUs were the most frequently used systems, facilitating high-performance training for deep learning models, particularly in S1, S3, S5, and S10. Additionally, CPUs and specialized devices, such as Raspberry Pi and Intel Core i7/i5 processors, were employed in studies focusing on IoT applications or resource-constrained environments, as seen in S14, S18, and S26.

Complementary tools also played a vital role in model optimization. For instance, OpenCV was extensively used for image and video processing (e.g., S13, S29), while Wireshark and tcpdump were employed for network traffic analysis and security detection (e.g., S10, S6). These tools, along with various APIs—such as REST APIs for system integration and Blockchain APIs for secure transactions—were instrumental in enhancing model efficiency, versatility, and overall performance.

3.6. RQ6—How Reliable Have These Systems Been Based on Key Model Evaluation Metrics (Accuracy, Precision, Recall, F1-Score)?

The effectiveness of the models trained in the analyzed studies was evaluated using multiple performance metrics, including accuracy, precision, recall, and F1-score. A summary of the results from studies where these metrics were assessed is presented in

Table 5. Summary statistics of model metrics in analyzed studies.

Statistics	Accuracy (%)	Precision (%)	Recall (%)	F1-Score (%)
Studies that use metric	39.00	33.00	32.00	31.00
Mean	97.44	96.13	96.06	96.00
Standard deviation	4.13	6.09	6.09	6.08
Min value	82.26	77.60	78.90	75.80
25%	97.13	96.91	96.89	96.29
50%	99.28	98.90	98.60	98.63
75%	99.74	99.54	99.44	99.29
Max value	100.00	100.00	100.00	100.00

. It is important to note that several studies used multiple datasets to validate their proposals, leading to multiple values being reported for each of the aforementioned metrics. In all cases, the analysis considered the set of metrics in which accuracy was the highest.

Accuracy (overall model precision; see Figure 6a) measures the percentage of correct predictions relative to the total number of predictions made. In the analyzed studies, the mean accuracy is approximately 97.44%, indicating that most models demonstrate strong overall classification performance. Additionally, the standard deviation is relatively low (4.13), suggesting that variability among models is well controlled. Notably, the best-performing studies in this metric are S32 (99.99%), S9 (99.96%), and S21 (99.74%), highlighting that architectures such as Deep Neural Networks and Gradient Boosting excel in detecting threats with high precision. Furthermore, 28 studies surpass the mean accuracy (S1, S2, S3, S6, S7, S9, S11, S12, S13, S14, S15, S16, S17, S18, S19, S21, S22, S24, S25, S27, S28, S32, S34, S35, S36, S38, S41, S43). On the other hand, models with the lowest accuracy, such as S4 (85.10%), S42 (82.26%), and S30 (88%), suggest that the techniques employed in these studies may not be sufficiently robust to detect certain attack patterns.

Similarly, precision (ability to avoid false positives; see Figure 6b) measures the proportion of positive predictions that were actually correct, helping to minimize false positives. The mean precision is approximately 96.13%, which indicates that most models successfully avoid misclassifying benign events as threats or violent actions. However, the standard deviation is higher (6.09), reflecting a greater variability among models. The studies with the highest precision are S19, S136, S43 (100%), S11 (99.91%), and S8 (99.90%), demonstrating the effectiveness of DNN-, CNN-, and XGBoost-based approaches in achieving an excellent balance in threat identification while minimizing excessive false positives. Moreover, 24 studies exceed the mean precision (S2, S3, S7, S8, S11, S12, S13 S15, S16, S17, S18, S19, S21, S22, S24, S25, S27, S28, S32, S33, S34, S36, S38, S43). Conversely, studies such as S42 (77.60%), S10 (81%), and S4 (84%) exhibit low precision, implying a higher false alarm rate and a potential lack of discrimination in classifying actual threats.

In addition, recall (ability to detect real threats; see Figure 6c) measures a model’s ability to correctly identify positive cases, thereby reducing false negatives. The mean recall is 96.06%, indicating that most models are highly effective in detecting attacks and critical events within the security context for which they were designed. The standard deviation is 6.09, showing some dispersion in values, with certain models achieving recall rates close to 100%, while others exhibit more limited performance. The best-performing studies in this metric are S19, S21, S36 (100%), S8 (99.9), and S18, S34 (98.9%), highlighting that methods based on Gradient Boosting, CNN, and LSTM effectively identify threats without overlooking critical events. Furthermore, 25 studies exceed the mean recall (S3, S7, S8, S11, S12, S13, S14, S15, S16, S17, S18, S19, S20, S21, S22, S24, S25, S27, S28, S32, S33, S34, S36, S38, S43). However, models with the lowest recall, such as S42 (78.9%), S10 (81), and S39 (82%), suggest that they may be failing to detect important attacks, which is critical in security scenarios.

Lastly, the F1-score (balance between precision and recall; see Figure 6d) is a metric that combines precision and recall, providing a balance between the ability to avoid false positives and the detection of real events. The mean F1-score is 96%, indicating that most models achieve an adequate equilibrium between both metrics. Nevertheless, the standard deviation is relatively high (6.08%), reflecting significant differences among models. The studies with the highest F1-scores are S19, S36 (100%), S21 (99.96%), and S8 (99.9%), suggesting that approaches such as DNN, Gradient Boosting, LSTM, and CNN-RNN-LSTM effectively capture complex patterns with high efficiency. Additionally, 23 studies surpass the mean F1-score (S3, S7, S8, S11, S12, S15, S16, S17, S18, S19, S21, S22, S24, S25, S27, S28, S32, S33, S34, S36, S38, S41, S43).

4. Discussion

The implementation of IoT-based intelligent surveillance systems and deep learning models has been redefining public security over the past decade, enabling real-time monitoring in both cyberspace and physical environments within smart cities. Digitalization and population growth have introduced new challenges in crime and violence detection, prompting governments to adopt innovative and automated solutions to enhance urban and digital security. China and India have emerged as leaders in this transformation, deploying large-scale AI-driven surveillance networks and IoT technologies. In China, facial recognition and behavioral analysis play a crucial role in the early detection of suspicious activities, whereas India has prioritized the implementation of IoT security infrastructures to safeguard public spaces and improve incident response capabilities. These strategies not only optimize security resources but also establish new global standards for automated citizen monitoring.

For developing countries, adopting these technologies presents a key opportunity to address high crime and violence rates through AI-based solutions that can complement or enhance existing security systems, as seen in Colombia, Mexico, and Chile. In Brazil, the “Smart Sampa” project [69] focuses on intrusion detection, theft prevention, facial recognition, and license plate reading, demonstrating an integrated approach to urban security. In Mexico, “Ciudad Segura” [70] implements panic buttons, emergency dispatch systems, and intelligent video surveillance, with a particular focus on women’s safety in public spaces. Colombia’s “Medellín Ciudad Segura” [71] advances video surveillance and alert management to enable rapid incident response. Meanwhile, Chile’s “Piloto Seguridad Pudahuel” [72] concentrates on gunshot detection to control armed violence, illustrating how AI can be leveraged to address specific security issues. A web search revealed that most countries in this region lack flagship projects utilizing AI for crime management, highlighting the need for crime detection models tailored to smart cities.

The need for highly precise and robust models is essential to ensure the effective detection of critical events such as fights, armed assaults, or terrorist attacks. However, a literature review revealed that only 17% of the analyzed studies propose solutions focused on violence and crime detection in physical environments. In contrast, 76% of the studies focus on cybersecurity, addressing intrusion detection, DDoS attacks, data manipulation, and vulnerabilities in IoT networks. This indicates a greater concern in the scientific community for protecting digital infrastructures, leaving an opportunity to develop deep learning applications for crime monitoring in urban spaces.

Studies have demonstrated that the most effective models for intrusion detection and IoT cybersecurity are those that combine deep learning with hyperparameter optimization and hybrid approaches. Techniques such as DNN, CNN, LSTM, and Gradient Boosting algorithms have achieved high accuracy rates, averaging 97.44% in the analyzed studies. However, some models exhibit deficiencies due to imbalanced datasets, insufficient parameter optimization, or approaches that prioritize one metric over another. To mitigate these limitations, several studies have combined deep learning with genetic algorithms, enabling the automatic selection of the most relevant features and fine-tuning of neural network hyperparameters, thereby improving model stability and accuracy in complex urban environments.

While IoT and deep learning-based security monitoring systems offer advantages such as 24/7 coverage and automated threat detection, they also introduce new vulnerabilities that can be exploited by malicious actors. Evidence shows that a high percentage of analyzed studies have addressed security concerns in data communication and network traffic within IoT infrastructures, primarily targeting smart surveillance cameras to prevent cyberattacks on interconnected devices in smart cities. Protecting these systems is crucial to prevent data manipulation and safeguard citizens’ privacy. However, regions with weak cybersecurity regulations face greater risks, underscoring the need to integrate advanced cybersecurity strategies and privacy models into the implementation of production-ready intelligent surveillance systems.

In various regions of Latin America and Africa, law enforcement agencies face technological and human resource limitations, making it difficult to effectively monitor large urban areas. Automated surveillance systems could serve as a strategic tool to enhance public security by enabling early incident detection and efficient police resource allocation. However, effective implementation requires investment in technological infrastructure and specialized training for security forces to accurately interpret data generated by these systems. Additionally, the growing demand for these solutions could position countries like India and China as global providers of intelligent surveillance technology, developing products tailored to the specific security needs of each region—similar to their expansion in other industries.

The findings of this study consolidate knowledge from various research efforts on the design and development of IoT-based crime and violence monitoring systems leveraging deep learning. These initiatives can serve as a reference for other countries seeking to implement or enhance technological solutions adapted to their sociopolitical and regulatory contexts. However, the advancement of these systems also raises ethical and legal challenges, as their implementation without adequate regulations could lead to privacy violations and the misuse of citizen data. Therefore, it is crucial to establish regulatory frameworks that balance security with the protection of individual rights, ensuring that these systems are transparent, accountable, and used exclusively for legitimate purposes. Only through ethical governance and well-defined regulations, which are currently not deeply addressed in the analyzed proposals, can these technologies contribute positively to global security without compromising fundamental freedoms.

5. Conclusions

The findings revealed that only 17% of the studies addressed monitoring and detection of crime and physical violence in urban environments. These studies primarily proposed automated systems for tracking violent incidents in public spaces, detecting property crimes such as theft and vandalism, recognizing aggressive behaviors and weapons, identifying intruders, and detecting hazardous objects in restricted areas. In contrast, studies on cybercrime, which accounted for 76%, focused on identifying anomalous patterns and complex cyberattacks, including botnet attacks, DoS/DDoS attacks, MQTT server intrusions, and malware infections. These efforts aimed to mitigate cyberattacks targeting IoT networks implemented in smart cities, which are particularly vulnerable due to the transmission of high-value data exploitable by cybercriminals.

Most of the analyzed proposals on crime and cybercrime detection in IoT networks were published in the last four years (2021–2024). The results indicate that India and China are at the forefront of crime monitoring in smart cities, driven by substantial government investments in AI-integrated IoT technologies. These countries have established the world’s largest systems for detecting crime patterns in urban environments, exemplified by India’s Smart City Mission and China’s Skynet Project. Both initiatives leverage IoT cameras and sensors to train sophisticated neural networks using large-scale datasets. Their success has led to highly efficient crime detection systems tailored to high-density urban populations, a characteristic shared by both nations, further reinforcing this study’s findings.

In the field of deep learning and IoT for public security, a variety of neural networks have been employed, with CNNs and LSTMs being the most widely used due to their pattern detection capabilities, often combined into hybrid architectures. These systems excel in incident prevention, automated surveillance, and threat prediction, achieving over 97.44% accuracy (average) in simulation environments, which supports their adoption in China and India for real-world security applications. However, despite these advancements, challenges persist, including dependence on high-quality training data, limited model replicability, and algorithmic biases, which may result in discrimination and violations of fundamental rights such as privacy, security, and personal integrity. Since these technologies rely on continuous data collection and monitoring, their deployment must be regulated to balance security measures with the protection of civil liberties.

Future research should further explore the integration of IoT and AI for crime monitoring, particularly in areas where automated surveillance remains underdeveloped, such as domestic violence, child abuse, sexual violence, and gender-based violence. Expanding research into these critical applications could have a profound social impact, enabling proactive interventions and enhanced protection for vulnerable populations. However, the deployment of such advanced systems in public spaces must adhere to stringent ethical guidelines and legal frameworks to safeguard individual rights and societal values.