Detection of abnormal behavior in smart-home environments

Without a doubt, the security of Internet of Things (IoT) systems is of crucial importance. The use of such systems has significantly increased in the recent year, where in every aspect of our daily life we interact with IoT environments and devices of any type. Therefore, it comes with no surprise that the relevant security concerns have attracted the focus of the security community and there is a rising need for security solutions in the IoT domain. GHOST is an EU Horizon 2020 Research and Innovation funded project, aiming at developing a reference architecture for securing smart-home IoT ecosystems. One of the approaches employed in GHOST project is to model the behavior of the IoT devices with regard to the network activity with the aim to detect and following mitigating cyber-security events. This functionality is mainly provided by two GHOST system modules, that is the Network and Data Flow Analysis (NDFA) and the Profile Builder (PB), described in detail in this paper.