Anomaly Detection in Smart Home Operation From User Behaviors and Home Conditions

Yamauchi, Masaaki; Ohsita, Yuichi; Murata, Masayuki; Ueda, Kunihiro; Kato, Yuki

doi:10.1109/tce.2020.2981636

Cited by 81 publications

(43 citation statements)

References 19 publications

(25 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Their method learns sequences of events for a predefined set of conditions and detects attacks by comparing the sequences of events, including the current operation, with the learned sequences. This work was extended in [18] and compared with a technique based on a hidden Markov model. It was tested on four users using smart home devices, but in a laboratory setting.…”

Section: B Behaviour-based Smart Home Idsmentioning

confidence: 99%

Self-Configurable Cyber-Physical Intrusion Detection for Smart Homes Using Reinforcement Learning

Heartfield

Loukas

Bezemskij

et al. 2021

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

The modern Internet of Things (IoT)-based smart 1 home is a challenging environment to secure: devices change, 2 new vulnerabilities are discovered and often remain unpatched, 3 and different users interact with their devices differently and 4 have different cyber risk attitudes. A security breach's impact is 5 not limited to cyberspace, as it can also affect or be facilitated 6 in physical space, for example, via voice. In this environment, 7 intrusion detection cannot rely solely on static models that 8 remain the same over time and are the same for all users.9We present MAGPIE, the first smart home intrusion detection 10 system that is able to autonomously adjust the decision function 11 of its underlying anomaly classification models to a smart home's 12 changing conditions (e.g., new devices, new automation rules and 13 user interaction with them). The method achieves this goal by 14 applying a novel probabilistic cluster-based reward mechanism 15 to non-stationary multi-armed bandit reinforcement learning. 16 MAGPIE rewards the sets of hyperparameters of its underlying 17 isolation forest unsupervised anomaly classifiers based on the 18 cluster silhouette scores of their output. 19 Experimental evaluation in a real household shows that MAG-20 PIE exhibits high accuracy because of two further innovations: 21 it takes into account both cyber and physical sources of data; 22 and it detects human presence to utilise models that exhibit the 23 highest accuracy in each case. MAGPIE is available in open-24 source format, together with its evaluation datasets, so it can 25 benefit from future advances in unsupervised and reinforcement 26 learning and be able to be enriched with further sources of data 27 as smart home environments and attacks evolve.

show abstract

Section: B Behaviour-based Smart Home Idsmentioning

confidence: 99%

Self-Configurable Cyber-Physical Intrusion Detection for Smart Homes Using Reinforcement Learning

Heartfield

Loukas

Bezemskij

et al. 2021

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…The authors in [ 20 , 46 ] improved the k-means clustering scheme for finding DDoS and misdirection attacks. To detect attacks in a home WSN, the authors of [ 47 ] used user-behaviors learning analysis. In [ 18 ], the authors used Restricted Boltzmann Machine-based Clustered IDS (RBC-IDS), a deep learning-based technique for tracking sensitive infrastructure utilizing three hidden layers for potential intruders.…”

Section: Background and Related Workmentioning

confidence: 99%

Feature-Selection and Mutual-Clustering Approaches to Improve DoS Detection and Maintain WSNs’ Lifetime

Ahmad

Wazirali

Bsoul

et al. 2021

Sensors

View full text Add to dashboard Cite

Wireless Sensor Networks (WSNs) continue to face two major challenges: energy and security. As a consequence, one of the WSN-related security tasks is to protect them from Denial of Service (DoS) and Distributed DoS (DDoS) attacks. Machine learning-based systems are the only viable option for these types of attacks, as traditional packet deep scan systems depend on open field inspection in transport layer security packets and the open field encryption trend. Moreover, network data traffic will become more complex due to increases in the amount of data transmitted between WSN nodes as a result of increasing usage in the future. Therefore, there is a need to use feature selection techniques with machine learning in order to determine which data in the DoS detection process are most important. This paper examined techniques for improving DoS anomalies detection along with power reservation in WSNs to balance them. A new clustering technique was introduced, called the CH_Rotations algorithm, to improve anomaly detection efficiency over a WSN’s lifetime. Furthermore, the use of feature selection techniques with machine learning algorithms in examining WSN node traffic and the effect of these techniques on the lifetime of WSNs was evaluated. The evaluation results showed that the Water Cycle (WC) feature selection displayed the best average performance accuracy of 2%, 5%, 3%, and 3% greater than Particle Swarm Optimization (PSO), Simulated Annealing (SA), Harmony Search (HS), and Genetic Algorithm (GA), respectively. Moreover, the WC with Decision Tree (DT) classifier showed 100% accuracy with only one feature. In addition, the CH_Rotations algorithm improved network lifetime by 30% compared to the standard LEACH protocol. Network lifetime using the WC + DT technique was reduced by 5% compared to other WC + DT-free scenarios.

show abstract

“…In some papers, a home network is simulated to implement methods for better learning, and this information is used to try to find a priority sequence to the extent that some activities are omitted for better learning and to discuss the accuracy and effectiveness of the proposed methods, a comparison is made with the methods of learning user behavior by Hidden Markov Models (Yamauchi et al, 2020). In some papers, it has an approach similar to the proposed approach of this article, and it has been similar in terms of statistical studies, and this combination of statistical techniques with machine learning techniques is evident.. Those templates are being calculated by combining machine learning techniques and statistical techniques according to their network behaviors in a smart house, so in these method, statistical measurements sometimes are used after processing to build clusters (Fahad, Rajarajan, 2015, Spanos et al, 2019.…”

Section: Related Workmentioning

confidence: 99%

Activity Recognition for Ambient Sensing Data and Rule Based Anomaly Detection

Ardebili

Eken

Küçük

2020

Int. Arch. Photogramm. Remote Sens. Spatial Inf. Sci.

View full text Add to dashboard Cite

Abstract. After a brief look at the smart home, we conclude that to have a smart home, and it is necessary to have an intelligent management center. In this article, We have tried to make it possible for the smart home management center to be able to detect the presence of an abnormal state in the behavior of someone who lives in the house. In the proposed method, the daily algorithm examines the rate of changes of a person and provides a number which is henceforth called NNC (Number of normal changes) based on the person’s behavioral changes. We achieve the NNC number using a machine learning algorithm and performing a series of several simple statistical and mathematical calculations. NNC is a number that shows abnormal changes in residents’ behaviors in a smart home, i.e., this number is a small number for a regular person with constant planning and for a person who may not have any fixed principles and regular in personal life is a big number.To increase our accuracy in calculating NNC, we review all common machine learning algorithms and after tests we choose the decision tree because of its higher accuracy and speed and finally, NNC number is obtained by combining the Decision Tree algorithm with statistical and mathematical methods. In this method, we present a set of states and information obtained from the sensors along with the activities performed by the occupant of the house over a period of several days to the proposed algorithm. and the method ahead generates the main NNC number for those days for anyone living in a smart home. To generate this main NNC, we calculate each person’s daily NNC. That means we have daily NNCs for each person (based on his/her behaviors on that day) and the main NNC is the average of these daily NNC. We chose ARAS dataset (Human Activity Datasets in Multiple Homes with Multiple Residents) to implement our method and after tests and replications on the ARAS dataset, and to find anomalies in each person’s behavior in a day, we compare the main (average) NNC with that person’s daily NNC on that day. Finally, we can say, if the main NNC changes more than 30%, there is a possibility of an abnormality. and if the NNC changes more than 60% percent, we can say that an abnormal state or an uncommon event happened that day, and a declaration of an abnormal state will be issued to the resident of the house.

show abstract

Anomaly Detection in Smart Home Operation From User Behaviors and Home Conditions

Cited by 81 publications

References 19 publications

Self-Configurable Cyber-Physical Intrusion Detection for Smart Homes Using Reinforcement Learning

Self-Configurable Cyber-Physical Intrusion Detection for Smart Homes Using Reinforcement Learning

Feature-Selection and Mutual-Clustering Approaches to Improve DoS Detection and Maintain WSNs’ Lifetime

Activity Recognition for Ambient Sensing Data and Rule Based Anomaly Detection

Contact Info

Product

Resources

About