Smart-home anomaly detection using combination of in-home situation and user behavior

• DOI: 10.48550/arxiv.2109.14348
• Publication Date: 2021-01-01
• Authors: Yamauchi, Masaaki; Tanaka, Masahiro; Ohsita, Yuichi; Murata, Masayuki; Ueda, Kensuke; Kato, Yoshiaki
• Keywords: FOS: Computer and information sciences; Computer Science - Cryptography and Security; 0202 electrical engineering, electronic engineering, information engineering; FOS: Electrical engineering, electronic engineering, information engineering; 02 engineering and technology; Systems and Control (eess.SY); Electrical Engineering and Systems Science - Systems and Control; Cryptography and Security (cs.CR)

Internet-of-things (IoT) devices are vulnerable to malicious operations by attackers, which can cause physical and economic harm to users; therefore, we previously proposed a sequence-based method that modeled user behavior as sequences of in-home events and a base home state to detect anomalous operations. However, that method modeled users' home states based on the time of day; hence, attackers could exploit the system to maximize attack opportunities. Therefore, we then proposed an estimation-based detection method that estimated the home state using not only the time of day but also the observable values of home IoT sensors and devices. However, it ignored short-term operational behaviors. Consequently, in the present work, we propose a behavior-modeling method that combines home state estimation and event sequences of IoT devices within the home to enable a detailed understanding of long- and short-term user behavior. We compared the proposed model to our previous methods using data collected from real homes. Compared with the estimation-based method, the proposed method achieved a 15.4% higher detection ratio with fewer than 10% misdetections. Compared with the sequence-based method, the proposed method achieved a 46.0% higher detection ratio with fewer than 10% misdetections.<br/>13 pages, 22 figures,<br/>