Anomaly Detection for Smart Home Based on User Behavior

Many devices, such as air conditioners and refrigerators, are now being connected to the Internet and, as a consequence, have become targets of cyberattacks. Especially, the operations by attackers can cause serious problems, which may harm users. However, such attacks are difficult to detect because they use the same protocol as legitimate operations by users. In this paper, we propose a method to detect such attacks based on user behavior. We model user behavior as a sequence of events, which includes the operation of IoT devices and other behavior monitored by any sensors. Our method learns sequences of events for each one of a predefined set of conditions and detects attacks by comparing the sequences of the events including the current operation with the learned sequences. We evaluate our method by using data collected by monitoring the behavior of four users. Based on the results of this evaluation, we demonstrate the accuracy of our method and discuss the limitations of our method.