Attack Detection in Smart Home IoT Networks using CluStream and Page-Hinkley Test

The expansion of IoT device networks increases the demand for security systems that detect attacks against these new targets. These devices have simple hardware, limited memory and processing power, and often are required to have low energy consumption. Batch supervised learning algorithms have been employed to address this issue, but they present some limitations. These algorithms demand benign and malicious labeled samples to be trained, which can be hard to obtain in real networks. Also, once they are trained, it is hard to update the learning model with newly found behaviors. In this work, we propose an online and unsupervised scheme to detect attacks in smart home IoT networks. This scheme is based on the combination of two algorithms: CluStream and Page-Hinkley Test. It does not require labeled samples to be trained and learns incrementally as it is used. Tests were performed over data obtained from publicly available datasets consisting of multiple smart home devices and the results are encouraging. Different types of attacks were detected with an overall detection rate around 97%, while the precision stayed above 87%.