IMEO: Anomaly Detection for IoT Devices using Semantic-based Correlations

In the Internet of Things (IoT) security, anomalies due to attacks or device malfunctions can have serious consequences in our daily lives. Previous solutions have been struggling with high rates of false alarms and missing many actual anomalies. They also take a long time to detect anomalies even if they successfully detect anomalies. To overcome the limitations, this paper proposes a novel anomaly detection system, named IoT Malfunction Extraction Observer (IMEO), that utilizes semantics and correlation information for smart homes. Given IoT devices installed at home, IMEO creates virtual correlations based on semantic information such as applications, device types, relation-ships, and installation locations. The generated correlations are validated and improved using event logs extracted from smart home applications. The finally extracted correlations are then used to simulate the normal behaviors of the smart home. Any discrepancy between the actual state of a device and the simulated state is reported as abnormal while comparing correlations and event logs. IMEO also utilizes the observation that malfunctions of IoT devices occur repeatedly. An anomaly database is created and used so that repetitive malfunctions are quickly detected, which eventually reduces processing time. This paper builds a smart home testbed on a real-world residential house and deploys IoT devices. Six different types of anomalies are analyzed, synthesized, and injected to the testbed, with which IMEO’s detection performance is evaluated and compared with the state-of-the-art correlation-only detection method. Experimental results demonstrate that the proposed method achieves higher performance of detection accuracy with faster processing time.

@article{Oh2024,
  title     = {IMEO: Anomaly Detection for IoT Devices using Semantic-based Correlations},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {15},
  number    = {2},
  year      = {2024},
  publisher = {The Science and Information Organization},
  author    = {Seungmin Oh and Jihye Hong and Daeho Kim and Eun-Kyu Lee and Junghee Jo},
  doi       = {10.14569/IJACSA.2024.0150289},
  url       = {https://doi.org/10.14569/IJACSA.2024.0150289}
}