HAWatcher: Semantics-Aware Anomaly Detection for Appified Smart Homes
HAWatcher: Semantics-Aware Anomaly Detection for Appified Smart Homes
复制标题
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Chenglong Fu;Qiang Zeng;Xiaojiang Du
中科院分区：
文献类型：
--
作者：
Chenglong Fu;Qiang Zeng;Xiaojiang Du
由于物联网设备通过自动化集成，并与物理环境相结合，因此智能家居的异常，无论是由于攻击还是设备故障，都可能导致严重后果。利用数据挖掘技术来检测异常的前期工作存在较高的误警率和许多真实异常的遗漏。我们的观察是，基于数据挖掘的方法遗漏了大量关于自动化程序(也称为智能应用程序)和设备的信息。提出了一种面向智能家居的语义感知异常检测系统HAWatcher(Home Automation Watcher)。HAWatcher基于事件日志和语义对智能家居的正常行为进行建模。给定一个家，HAWatcher根据应用程序、设备类型、关系和安装位置等语义信息生成假设关联，并使用事件日志进行验证。挖掘的关联是使用从安装的智能应用程序中提取的关联来提炼的。影子执行引擎使用细化的关联来模拟智能家居的正常行为。在运行期间，设备的真实状态和模拟状态之间的不一致被报告为异常。我们在SmartThings平台上的四个真实测试床上对我们的原型进行了评估，并针对总共62个不同的异常情况进行了测试。结果表明，HAWatcher达到了较高的准确率，显著优于以往的方法。
As IoT devices are integrated via automation and coupled with the physical environment, anomalies in an appified smart home, whether due to attacks or device malfunctions, may lead to severe consequences. Priorworks that utilize data mining techniques to detect anomalies suffer from high false alarm rates and missing many real anomalies. Our observation is that data mining-based approaches miss a large chunk of information about automation programs (also called smart apps ) and devices. We propose Home Automation Watcher (HAWatcher), a semantics-aware anomaly detection system for appified smart homes. HAWatcher models a smart home’s normal behaviors based on both event logs and semantics. Given a home, HAWatcher generates hypothetical correlations according to semantic information, such as apps, device types, relations and installation locations, and verifies them with event logs. The mined correlations are refined using correlations extracted from the installed smart apps. The refined correlations are used by a Shadow Execution engine to simulate the smart home’s normal behaviors. During run-time, inconsistencies between devices’ real-world states and simulated states are reported as anomalies. We evaluate our prototype on the SmartThings platform in four real-world testbeds and test it against totally 62 different anomaly cases. The results show that HAWatcher achieves high accuracy, significantly outperforming prior approaches.