Abstract:Although home IoT (Internet of Things) devices are typically plain and task oriented, the context of their daily use may affect their traffic patterns. For this reason, anomaly-based intrusion detection systems tend to suffer from a high false positive rate (FPR). To overcome this, we propose a two-step collaborative anomaly detection method which first uses an autoencoder to differentiate frequent (`benign') and infrequent (possibly `malicious') traffic flows. Clustering is then used to analyze only the infrequent flows and classify them as either known ('rare yet benign') or unknown (`malicious'). Our method is collaborative, in that (1) normal behaviors are characterized more robustly, as they take into account a variety of user interactions and network topologies, and (2) several features are computed based on a pool of identical devices rather than just the inspected device. We evaluated our method empirically, using 21 days of real-world traffic data that emanated from eight identical IoT devices deployed on various networks, one of which was located in our controlled lab where we implemented two popular IoT-related cyber-attacks. Our collaborative anomaly detection method achieved a macro-average area under the precision-recall curve of 0.841, an F1 score of 0.929, and an FPR of only 0.014. These promising results were obtained by using labeled traffic data from our lab as the test set, while training the models on the traffic of devices deployed outside the lab, and thus demonstrate a high level of generalizability. In addition to its high generalizability and promising performance, our proposed method also offers benefits such as privacy preservation, resource savings, and model poisoning mitigation. On top of that, as a contribution to the scientific community, our novel dataset is available online.

Effective Anomaly Detection in Smart Home by Integrating Event Time Intervals

Fault Detection for Binary Sensors in Smart Home Environments

Detecting Abnormal Events on Binary Sensors in Smart Home Environments

Anomaly Event Detection in Temporal Sensor Network Data of Intelligent Environments

SeIoT: Detecting Anomalous Semantics in Smart Homes Via Knowledge Graph

CADeSH: Collaborative Anomaly Detection for Smart Homes

Time Series Anomaly Detection in Smart Homes: A Deep Learning Approach

Leveraging power consumption for anomaly detection on IoT devices in smart homes

Anomaly Detection Models for IoT Time Series Data

LSTM-Markov based efficient anomaly detection algorithm for IoT environment

Make Your Home Safe: Time-aware Unsupervised User Behavior Anomaly Detection in Smart Homes via Loss-guided Mask

TS-PADM: Anomaly Detection Model of Wireless Sensors Based on Spatial-Temporal Feature Points

Smart Anomaly Detection in Sensor Systems: A Multi-Perspective Review

An anomaly-introduced learning method for abnormal event detection

Periodic Behavioral Routine Discovery Based on Implicit Spatial Correlations for Smart Home

Fine-Grained Multivariate Time Series Anomaly Detection in IoT

Detecting Urban Anomalies Using Multiple Spatio-Temporal Data Sources

Time Series Anomaly Detection for ICS via Multidimensional Features and Spectral Residuals

Wavelet-based temporal models of human activity for anomaly detection in smart robot-assisted environments

A Comparative Study of Time Series Anomaly Detection Models for Industrial Control Systems

An Error Neighborhood-Based Detection Mechanism to Improve the Performance of Anomaly Detection in Industrial Control Systems