Anomaly detection aims to automatically identify what deviates from a system’s usual behavior, known as “habitual” behavior, particularly in IoT applications for security and system supervision, as well as for the protection and preservation of personal data and user privacy. In his HDR, Nouredine TAMANI proposes formally defining “normality” as well as its anomaly detection process in order to effectively detect suspicious situations, considering two complementary approaches, namely: a numerical approach based on statistical learning, where anomaly detection algorithms abound but normality is not formally defined, and a semantic approach based on first-order logic, where the specification of normality is formally defined but no anomaly detection process exists. His work shows that these explainable approaches can be optimized to handle large volumes of information and improve response times under real-world conditions in cybersecurity applications.