As several home appliances, such as air conditioners, heaters, and refrigerators, were connecting to the Internet, they became targets of cyberattacks, which cause serious problems such as compromising safety and even harming users. We have proposed a method to detect such attacks based on user behavior. This method models user behavior as sequences of user events including operation of home IoT (Internet of Things) devices and other monitored activities. Considering users behave depending on the condition of the home such as time and temperature, our method learns event sequences for each condition. To mitigate the impact of events of other users in the home included in the monitored sequence, our method generates multiple event sequences by removing some events and learning the frequently observed sequences. For evaluation, we constructed an experimental network of home IoT devices and recorded time data for four users entering/leaving a room and operating devices. We obtained detection ratios exceeding 90% for anomalous operations with less than 10% of misdetections when our method observed event sequences related to the operation. In this article, we also discuss the effectiveness of our method by comparing with a method learning users’ behavior by Hidden Markov Models.

中文翻译：

---

基于用户行为和家居条件的智能家居操作异常检测

空调、暖气、冰箱等多款家用电器接入互联网后，成为网络攻击的目标，造成安全隐患，甚至危害用户的严重问题。我们提出了一种基于用户行为检测此类攻击的方法。该方法将用户行为建模为用户事件序列，包括家庭 IoT（物联网）设备的操作和其他受监控的活动。考虑到用户的行为取决于家庭条件，例如时间和温度，我们的方法学习每个条件的事件序列。为了减轻监控序列中包含的家中其他用户事件的影响，我们的方法通过删除一些事件并学习经常观察到的序列来生成多个事件序列。对于评估，我们构建了家庭物联网设备的实验网络，并记录了四个用户进出房间和操作设备的时间数据。当我们的方法观察到与操作相关的事件序列时，我们获得了超过 90% 的异常操作检测率，误检测率低于 10%。在本文中，我们还通过与通过隐马尔可夫模型学习用户行为的方法进行比较来讨论我们方法的有效性。