Make Your Home Safe: Time-aware Unsupervised User Behavior Anomaly Detection in Smart Homes via Loss-guided Mask (2024)

1. Introduction

The rapid growth of IoT solutions has led to an unprecedented increase in smart devices within homes, expected to reach approximately 5 billion by 2025 (Lueth, 2018). However, the abnormal behaviors pose substantial security risks within smart homes. These abnormal behaviors usually originate from two primary sources. First, improper operations by users can cause abnormal behaviors, such as inadvertently activating the air conditioner’s cooling mode during winter or forgetting to close a water valve. Second, malicious attackers can exploit vulnerabilities within IoT devices and platforms, taking unauthorized control of these devices. For example, hackers can compromise IoT platforms, allowing them to disable security cameras and manipulate home automation systems, creating opportunities for burglary. These security concerns emphasize the urgency of robust behavioral modeling methods and enhanced security measures to safeguard smart home environments.

Deep learning has been employed across various domains to mine correlations between behaviors for modeling user behavior sequences (Tang etal., 2022, 2023; Li etal., 2024). DeepMove(Feng etal., 2018) leverages RNNs to model both long and short-term mobility patterns of users for human mobility prediction. To capture the dynamics of user’s behaviors, SASRec (Kang and McAuley, 2018) proposes a self-attention based model to achieve sequential recommendation. More recent efforts(Chen etal., 2019; Sun etal., 2019; deSouza PereiraMoreira etal., 2021) primarily focus on transformer-based models for their superior ability to handle sequential behavior data.

However, we cannot borrow the above models to directly apply them in our scenarios, because of the following three challenges of user behavior modeling in smart homes.

First, the occurrence frequencies of different user behaviors may be imbalanced, leading to challenges in learning the semantics of these behaviors. This user behavior imbalance can be attributed to individuals’ living habits. For example, cook-related behaviors (e.g., using microwave and oven) of office workers may be infrequent, because they dine at their workplace on weekdays and only cook on weekends. On the other hand, some daily behaviors like turning on lights and watching TV of the same users can be more frequent. Behavior imbalance complicates the learning process for models: some behaviors, which occur frequently in similar contexts, can be easily inferred, while others that rarely appear or manifest in diverse contexts can be more challenging to infer. We train an autoencoder model on AN dataset (shown in Table1), record the occurrences and reconstruction loss of different behaviors. As shown in Figure1, with the number of occurrences of behavior decreases, the reconstruction loss tends to increase.

Second, temporal context, e.g., the timing and duration of user behaviors, plays a significant role in abnormal behavior detection but is overlooked by existing solutions. For example, turning on the cooling mode of the air conditioner in winter is abnormal, but is normal in summer. Showering for 30-40 minutes is normal, but exceeding 2 hour suggests a user accident. Ignoring timing information hinders the identification of abnormal behavior patterns. As shown in Figure2, sequence 1 represents a user’s normal laundry-related behaviors. Sequences 2 and 3 follow the same order as sequence 1. However, in sequence 2, the water valve were opens at 2 o’clock in the night. In sequence 3, the duration between opening and closing the water valve is excessively long. Therefore these two sequences should be identified as abnormal behaviors possibly conducted by attackers intending to induce water leakage.

Third, arbitrary intents and passive device actions can cause noise behaviors in user behavior sequences, which interfere model’s inference. Figure3 shows noise behaviors in a behavior sequence related to a user’s behaviors after getting up. The user do some routine behaviors like “turn on the bed light”, “open the curtains”, “switch off the air conditioner”, “open the refrigerator”, “close the refrigerator” and “switch on the oven”. However, there are also some sporadic actions which are not tightly related to the behavior sequence, including 1) active behaviors, e.g., suddenly deciding to “turn on the network audio” to listen to music; 2) passive behavior from devices, e.g., the “self-refresh” of the air purifier. These noise behaviors may also occur in other sequences with varying patterns.These noise behaviors introduces uncertainty that can disrupt the learning process and lead the model to misclassify sequences containing noise behaviors as anomalies. Therefore, treating noise behaviors on par with normal behaviors could potentially harm the model’s performance, leading to increased losses.

In this paper, we propose SmartGuardto solve above challenges. SmartGuardis an autoencoder-based architecture, which learns to reconstruct normal behavior sequences during training and identify the behavior sequences with high reconstruction loss as anomaly. Firstly, we devise a Loss-guided Dynamic Mask Strategy (LDMS) to promote the model’s learning of infrequent hard-to-learn behaviors. Secondly, we introduce a Three-level Time-aware Position Embedding (TTPE) to integrate temporal information into positional embedding for detecting temporal context anomalies. Lastly, we propose a Noise-aware Weighted Reconstruction Loss (NWRL) to assign distinct weights to routine behaviors and noise behaviors, thereby mitigating the impact of noise behaviors. Our codes are released to the GitHub ¹¹1https://github.com/xjywhu/SmartGuard. Our contributions can be summarized as follows:

2. Related Work

3. Problem Formulation

Let $\mathcal{D}$ denote a set of devices, $\mathcal{C}$ denote a set of device controls and $\mathcal{S}$ denote a set of behavior sequences.

For example, behavior b = (2022-08-04 18:30, air conditioner, air conditioner:switch on) describes the behavior “swich on the air conditioner” at 18:30 on 2022-08-04.

We define the User Behavior Sequence (UBS) anomaly detection problem as follows.

4. Methodology

4.2. Loss-guided Dynamic Mask Strategy

Autoencoders (Zhai etal., 2018), which take complete data instances as input and target to reconstruct the entire input data, are widely used in anomaly detection. Different from traditional autoencoders, masked autoencoders randomly mask a portion of input data, encoding the partially-masked data and aiming to reconstruct the masked tokens. By introducing a more meaningful self-supervised task, masked autoencoders have recently excelled in images (He etal., 2022) learning. However, such reconstruction tasks without mask and with random mask are sub-optimal in our scenarios because they do not emphasize the learning of hard-to-learn behaviors that occur rarely.

We conduct experiments to verify the performance of autoencoders trained with three mask options:1) w/o mask: no mask strategy is used, the objective function is to reconstruct the input; 2) random mask: masking behaviors at every epoch randomly to reconstruct the masked behaviors; 3) top-$k$ loss mask: masking top $k$ behaviors with higher reconstruction loss to reconstruct the masked behaviors. We set mask ratio as 20% for the latter two.Figure6 shows the changing trends of the reconstruction loss and it’s variance of different behavior during training on SP dataset (described in Table1).First, as shown in Figure6(a), the model without mask shows the fastest convergence trend, whereas the loss of the model with mask fluctuates. Model without mask can simultaneously learn all behaviors, facilitating rapid convergence. In contrast, the mask strategy only encourages the model to focus on learning masked behaviors, which may hinder initial-stage convergence. Second, the model with top-$k$ loss mask strategy shows lowest variance towards the end of training as shown in Figure6(b), because the top-$k$ loss mask strategy effectively encourages the model to learn hard-to-learn behaviors (i.e., the behaviors with high reconstruction loss), thereby reducing the variance of behavior reconstruction losses.

In this paper, we design a Loss-guided Dynamic Mask Strategy. Intuitively, at the beginning of training, we encourage the model to learn the relatively easy task to accelerate convergence, i.e., behavior sequence reconstruction without mask. After training $N$ epochs without mask, we adopt the top-$k$ loss mask strategy to encourage the model to learn the masked behaviors with high reconstruction loss. We continuously track the model’s reconstruction loss of different behaviors by updating a loss vector in each epoch to guide the mask strategy in the next epoch. In epoch $ep$, the loss vector $\mathcal{L}^{ep}_{\text{vec}}$ is calculated as:

(1)

$$\mathcal{L}^{ep}_{\text{vec}}=\left\{\ell_{1},\ell_{2},\ldots,\ell_{c},\ldots,$$

(2)

$$\ell_{c}=\frac{1}{n_{c}}\sum_{i=1}^{n_{c}}\ell^{i}_{c},$$

where $n_{c}$ is the number of times the device control $c$ occurs in epoch $ep$, and $\ell_{c}$ is the average reconstruction loss of the device control $c$.In epoch $ep+1$, the mask vector for behavior sequence sample $s=[b_{1},b_{2},\cdots,b_{n}]$ is obtained as:

(3)

$$mask(i)=\left\{\begin{array}[]{rl}1,&\text{if}\ i\in sorted\_index[:\lfloor n$$

(4)

$$sorted\_index=\operatorname{argsort}\left(\left\{\mathcal{L}^{ep}_{\text{vec}}$$

where $\operatorname{argsort}$ gets the sorted index with descending order of the elements in the vector, $r\in[0,1]$ is the mask ratio, and $n$ is the length of behavior sequence $s$.

5. Experiments

In this section, we conduct comprehensive experiments on three real-world datasets to answer the following key questions:

5.4. Parameter Study (RQ3)

5.4.1. The mask ratio $r$ and the training step $N$ without mask

Figure7 illustrates that SmartGuardachieves the optimal performance when $r=0.4$ and $N=5$. The parameter $r$ (Equation3) determines the difficulty of the model learning task. A smaller $r$ fails to effectively encourage the model to learn hard-to-learn behaviors, while a larger $r$ increases the learning burden on the model, consequently diminishing performance. As for training steps without a mask, a smaller $N$ hinders the model from converging effectively at the beginning stage, whereas a larger $N$ impedes the model’s ability to learn hard-to-learn behaviors towards the end, resulting in degraded performance.

5.4.2. $\mu$ of Noise-aware Weighted Reconstruction Loss

The parameter $\mu$(Equation17) controls the weights assigned to potential noise behaviors. A smaller $\mu$ results in a smaller weight for noise behaviors, while a larger $\mu$ leads to a greater weight for noise behaviors. As illustrated in Figure8(a), the False Positive Rate gradually decreases as $\mu$ decreases, benefiting from the reduced loss weight assigned to noise behaviors. However, as depicted in Figure8(b), the False Negative Rate slightly increases as $\mu$ decreases. When $\mu=0.1$, SmartGuardachieves a balance, minimizing both the False Positive Rate and the False Negative Rate.

5.4.3. The embedding size $em$

We fine-tune the embedding size for time and device control, ranging from 8 to 512. As depicted in Figure9(a), an initial increase in the embedding dimension results in a notable performance improvement, which is attributed to the larger dimensionality enabling behavior embedding to capture more comprehensive information about the context, thereby furnishing valuable representations for other modules in SmartGuard. Nevertheless, excessively large sizes (e.g., ¿ 256) can lead to performance degradation due to over-fitting.

5.4.4. Number of layers $L$ of encoder and decoder

Figure9(b) shows the performance of SmartGuardwith different numbers of layers. When $L$ increases, F1-Score first increases and then decreases, reaching the optimal value at 3 layers, because fewer layers leads to under-fitting, and too many layers leads to over-fitting.

5.5. Case Study (RQ4)

To assess the interpretability of SmartGuard, we select a behavior sequence from the test set of the AN dataset and visualize its attention weights and reconstruction loss. Illustrated in Figure10, the user initiated a sequence of actions: turning off the TV, stopping the sweeper, closing the curtains, switching off the bedlight, and locking the smart lock before going to sleep. Subsequently, an attacker took control of IoT devices, turning off the camera, and opening the window for potential theft. Examining Figure10(a), we observe that the attention weights between behaviors $b_{6}$, $b_{7}$, $b_{8}$, and other behaviors in the sequence are relatively smaller. This suggests that $b_{6}$, $b_{7}$, $b_{8}$, and other behaviors lack contextual relevance and are likely abnormal. Turning to Figure10(b), the reconstruction losses for behaviors $b_{6}$, $b_{7}$, and $b_{8}$ are notably high. SmartGuardidentifies these anomalies in the sequence, triggering an immediate alarm.

5.6. Embedding Space Analysis (RQ5)

We visualize the similarity between device embeddings and time embeddings (i.e., hour embedding, day embedding and duration embeddings) to analyze whether the model effectively learns the relationship between behaviors. As shown in Figure11(a), opening the curtains usually occurs between 6-9 and 9-12 o’clock because users usually get up during this period, while closing the curtains generally occurs between 21-24 o’clock because the user usually go to bed during this period. The dishwasher usually runs between 12-15 and 18-21 o’clock, which means that the user has lunch and dinner during this period, and then washes the dishes. As shown in Figure11(b), users generally watch TV and do laundry on Saturdays and Sundays. As shown in Figure11(c), users usually take a bath for about 1-2 hours, bath time longer than this may indicate abnormality occurs.

6. Conclusion

In this paper, we introduce SmartGuardfor unsupervised user behavior anomaly detection. We first devise a Loss-guided Dynamic Mask Strategy (LDMS) to encourage the model to learn less frequent behaviors that are often overlooked during the learning process. Additionally, we introduce Three-level Time-aware Position Embedding (TTPE) to integrate temporal information into positional embedding, allowing for the detection of temporal context anomalies. Furthermore, we propose a Noise-aware Weighted Reconstruction Loss (NWRL) to assign distinct weights for routine behaviors and noise behaviors, thereby mitigating the impact of noise. Comprehensive experiments conducted on three datasets encompassing ten types of anomaly behaviors demonstrate that SmartGuardconsistently outperforms state-of-the-art baselines while delivering highly interpretable results.

References

• (1)
• Amraoui and Zouari (2021)Noureddine Amraoui and Belhassen Zouari. 2021.An ml behavior-based security control for smart home systems. In Risks and Security of Internet and Systems: 15th International Conference, CRiSIS 2020, Paris, France, November 4–6, 2020, Revised Selected Papers 15. Springer, 117–130.
• Celik etal. (2018)Z.Berkay Celik, Leonardo Babun, AmitKumar Sikder, Hidayet Aksu, Gang Tan, PatrickD. McDaniel, and A.Selcuk Uluagac. 2018.Sensitive Information Tracking in Commodity IoT. In 27th USENIX Security Symposium, USENIX Security 2018, Baltimore, MD, USA, August 15-17, 2018, William Enck and AdriennePorter Felt (Eds.). USENIX Association, 1687–1704.https://www.usenix.org/conference/usenixsecurity18/presentation/celik
• Chen etal. (2019)Qiwei Chen, Huan Zhao, Wei Li, Pipei Huang, and Wenwu Ou. 2019.Behavior sequence transformer for e-commerce recommendation in alibaba. In Proceedings of the 1st international workshop on deep learning practice for high-dimensional sparse data. 1–4.
• Chen etal. (2018)Zhaomin Chen, ChaiKiat Yeo, BuSung Lee, and ChiewTong Lau. 2018.Autoencoder-based network anomaly detection. In 2018 Wireless telecommunications symposium (WTS). IEEE, 1–5.
• Cheng etal. (2019)Zhangyu Cheng, Chengming Zou, and Jianwei Dong. 2019.Outlier detection using isolation forest and local outlier factor. In Proceedings of the conference on research in adaptive and convergent systems. 161–168.
• Chi etal. (2022)Haotian Chi, Chenglong Fu, Qiang Zeng, and Xiaojiang Du. 2022.Delay Wreaks Havoc on Your Smart Home: Delay-based Automation Interference Attacks. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022. IEEE, 285–302.https://doi.org/10.1109/SP46214.2022.9833620
• deSouza PereiraMoreira etal. (2021)Gabriel de Souza PereiraMoreira, Sara Rabhi, JeongMin Lee, Ronay Ak, and Even Oldridge. 2021.Transformers4rec: Bridging the gap between nlp and sequential/session-based recommendation. In Proceedings of the 15th ACM Conference on Recommender Systems (RecSys). 143–153.
• Feng etal. (2018)Jie Feng, Yong Li, Chao Zhang, Funing Sun, Fanchao Meng, Ang Guo, and Depeng Jin. 2018.DeepMove: Predicting Human Mobility with Attentional Recurrent Networks. In Proceedings of the 2018 World Wide Web Conference (Lyon, France) (WWW ’18). International World Wide Web Conferences Steering Committee, Republic and Canton of Geneva, CHE, 1459–1468.https://doi.org/10.1145/3178876.3186058
• Fernandes etal. (2016)Earlence Fernandes, Jaeyeon Jung, and Atul Prakash. 2016.Security Analysis of Emerging Smart Home Applications. In Proceedings of IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA.
• Fu etal. (2022)Chenglong Fu, Qiang Zeng, Haotian Chi, Xiaojiang Du, and SivaLikitha Valluru. 2022.IoT Phantom-Delay Attacks: Demystifying and Exploiting IoT Timeout Behaviors. In 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2022, Baltimore, MD, USA, June 27-30, 2022. IEEE, 428–440.https://doi.org/10.1109/DSN53405.2022.00050
• Fu etal. (2021)Chenglong Fu, Qiang Zeng, and Xiaojiang Du. 2021.HAWatcher: Semantics-Aware Anomaly Detection for Appified Smart Homes. In 30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021, MichaelD. Bailey and Rachel Greenstadt (Eds.). USENIX Association, 4223–4240.https://www.usenix.org/conference/usenixsecurity21/presentation/fu-chenglong
• Gu etal. (2020)Tianbo Gu, Zheng Fang, Allaukik Abhishek, Hao Fu, Pengfei Hu, and Prasant Mohapatra. 2020.IoTGaze: IoT Security Enforcement via Wireless Context Analysis. In 39th IEEE Conference on Computer Communications, INFOCOM 2020, Toronto, ON, Canada, July 6-9, 2020. IEEE, 884–893.https://doi.org/10.1109/INFOCOM41043.2020.9155459
• He etal. (2022)Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. 2022.Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 16000–16009.
• Jeon etal. (2022)Hyunsik Jeon, Jongjin Kim, Hoyoung Yoon, Jaeri Lee, and U Kang. 2022.Accurate action recommendation for smart home via two-level encoders and commonsense knowledge. In Proceedings of the 31st ACM International Conference on Information and Knowledge Management (CIKM). 832–841.
• Jia etal. (2017)YunhanJack Jia, QiAlfred Chen, Shiqi Wang, Amir Rahmati, Earlence Fernandes, ZhuoqingMorley Mao, and Atul Prakash. 2017.ContexloT: Towards Providing Contextual Integrity to Appified IoT Platforms. In 24th Annual Network and Distributed System Security Symposium, NDSS 2017, San Diego, California, USA, February 26 - March 1, 2017. The Internet Society.https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/contexlot-towards-providing-contextual-integrity-appified-iot-platforms/
• Kang and McAuley (2018)Wang-Cheng Kang and Julian McAuley. 2018.Self-attentive sequential recommendation. In 2018 IEEE international conference on data mining (ICDM). IEEE, 197–206.
• Kingma and Ba (2014)DiederikP Kingma and Jimmy Ba. 2014.Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980 (2014).
• Li etal. (2024)Fan Li, Xu Si, Shisong Tang, Dingmin Wang, Kunyan Han, Bing Han, Guorui Zhou, Yang Song, and Hechang Chen. 2024.Contextual Distillation Model for Diversified Recommendation.arXiv preprint arXiv:2406.09021 (2024).https://arxiv.org/abs/2406.09021
• Liu etal. (2008)FeiTony Liu, KaiMing Ting, and Zhi-Hua Zhou. 2008.Isolation forest. In 2008 eighth ieee international conference on data mining. IEEE, 413–422.
• Lueth (2018)KnudLasse Lueth. 2018.State of the IoT 2018: Number of IoT devices now at 7B – Market accelerating.https://iot-analytics.com/state-of-the-iot-update-q1-q2-2018-number-of-iot-devices-now-7b/.
• Paszke etal. (2019)Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, etal. 2019.Pytorch: An imperative style, high-performance deep learning library.Advances in Neural Information Processing Systems (NIPS) 32 (2019).
• Rieger etal. (2023)Phillip Rieger, Marco Chilese, Reham Mohamed, Markus Miettinen, Hossein Fereidooni, and Ahmad-Reza Sadeghi. 2023.ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks. In Proceedings of the 32nd USENIX Conference on Security Symposium (Anaheim, CA, USA) (SEC ’23). USENIX Association, USA, Article 241, 18pages.
• Sikder etal. (2017)AmitKumar Sikder, Hidayet Aksu, and ASelcuk Uluagac. 2017.$\{$6thSense$\}$: A context-aware sensor-based attack detector for smart devices. In 26th USENIX Security Symposium (USENIX Security 17). 397–414.
• Sikder etal. (2019)AmitKumar Sikder, Leonardo Babun, Hidayet Aksu, and A.Selcuk Uluagac. 2019.Aegis: A Context-Aware Security Framework for Smart Home Systems. In Proceedings of the 35th Annual Computer Security Applications Conference (San Juan, Puerto Rico, USA) (ACSAC ’19). Association for Computing Machinery, New York, NY, USA, 28–41.https://doi.org/10.1145/3359789.3359840
• Srinivasan etal. (2008)Vijay Srinivasan, JohnA. Stankovic, and Kamin Whitehouse. 2008.Protecting your daily in-home activity information from a wireless snooping attack. In UbiComp 2008: Ubiquitous Computing, 10th International Conference, UbiComp 2008, Seoul, Korea, September 21-24, 2008, Proceedings (ACM International Conference Proceeding Series, Vol.344), HeeYong Youn and We-Duke Cho (Eds.). ACM, 202–211.https://doi.org/10.1145/1409635.1409663
• Sun etal. (2019)Fei Sun, Jun Liu, Jian Wu, Changhua Pei, Xiao Lin, Wenwu Ou, and Peng Jiang. 2019.BERT4Rec: Sequential recommendation with bidirectional encoder representations from transformer. In Proceedings of the 28th ACM International Conference on Information and Knowledge Management (CIKM). 1441–1450.
• Tang etal. (2022)Shisong Tang, Qing Li, Xiaoteng Ma, Ci Gao, Dingmin Wang, Yong Jiang, Qian Ma, Aoyang Zhang, and Hechang Chen. 2022.Knowledge-based temporal fusion network for interpretable online video popularity prediction. In Proceedings of the ACM Web Conference 2022. 2879–2887.
• Tang etal. (2023)Shisong Tang, Qing Li, Dingmin Wang, Ci Gao, Wentao Xiao, Dan Zhao, Yong Jiang, Qian Ma, and Aoyang Zhang. 2023.Counterfactual Video Recommendation for Duration Debiasing. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 4894–4903.
• Vaswani etal. (2017)Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, AidanN Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017.Attention is all you need.Advances in Neural Information Processing Systems (NIPS) 30 (2017).
• Wang etal. (2023)Jincheng Wang, Zhuohua Li, Mingshen Sun, Bin Yuan, and John C.S. Lui. 2023.IoT Anomaly Detection Via Device Interaction Graph. In 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Network, DSN 2023, Porto, Portugal, June 27-30, 2023. IEEE, 494–507.https://doi.org/10.1109/DSN58367.2023.00053
• Xiao etal. (2023a)Jingyu Xiao, Qingsong Zou, Qing Li, Dan Zhao, Kang Li, Wenxin Tang, Runjie Zhou, and Yong Jiang. 2023a.User Device Interaction Prediction via Relational Gated Graph Attention Network and Intent-aware Encoder. In Proceedings of the 2023 International Conference on Autonomous Agents and Multiagent Systems (AAMAS). 1634–1642.
• Xiao etal. (2023b)Jingyu Xiao, Qingsong Zou, Qing Li, Dan Zhao, Kang Li, Zixuan Weng, Ruoyu Li, and Yong Jiang. 2023b.I Know Your Intent: Graph-enhanced Intent-aware User Device Interaction Prediction via Contrastive Learning.Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies (IMUWT/UbiComp) 7, 3 (2023), 1–28.
• Zhai etal. (2018)Junhai Zhai, Sufang Zhang, Junfen Chen, and Qiang He. 2018.Autoencoder and its various variants. In 2018 IEEE international conference on systems, man, and cybernetics (SMC). IEEE, 415–419.
• Zou etal. (2023)Qingsong Zou, Qing Li, Ruoyu Li, Yucheng Huang, Gareth Tyson, Jingyu Xiao, and Yong Jiang. 2023.IoTBeholder: A Privacy Snooping Attack on User Habitual Behaviors from Smart Home Wi-Fi Traffic.Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies (IMWUT/UbiComp) 7, 1 (2023), 1–26.

Appendix A Appendices

A.3. Data collection

Testbed and Participants. To create a practical and viable smart home model, we implemented our experimental platform within an apartment setting to gather user usage data of various devices, forming our smart home user behavior dataset (AN). Three volunteers were recruited to simulate the typical daily activities of a standard family, assuming the roles of an adult male, an adult female, and a child. The experimental platform comprises a comprehensive selection of 36 popular market-available devices, detailed in Table6, with their deployment illustrated in Figure12.

Normal Behavior Collection. We enlisted volunteers to reside in apartments and encouraged them to utilize equipment in accordance with their individual habits. Throughout the designated period of occupancy, we refrained from actively or directly intervening in the users’ behavior. However, we implemented a system where users consistently logged their activities. Following the conclusion of the data collection phase, we reviewed the device usage logs via the smart home app, amalgamating these logs with the users’ behavior records to compile a comprehensive user behavior dataset. To mitigate potential biases arising from acclimating to a new living environment, participants were required to inhabit the experimental setting for a minimum of two weeks before the formal commencement of data collection. All users possessed comprehensive knowledge of the IoT devices and applications in use. Subsequent to check-in, control of all devices was relinquished to the users, who were duly informed in advance that their device usage would be subsequently reviewed and analyzed by our team

Anomaly Behavior Injection. We insert abnormal behaviors in Table2 into normal behavior sequences to construct abnormal behavior sequences. Then the abnormal behavior sequences. Then the abnormal behavior sequence and the normal behavior sequence together form the test dataset. The anomaly behavior sequences examples are shown in Figure13.

A.5. Mask strategy deep dive

To verify the effectiveness of LDMS, we compared it with the three baselines (w/o mask, random mask and top-$k$ loss mask) mentioned in the section 4.2. As illustrated in Figure14(a), LDMS consistently outperforms all other mask strategies across four types of anomalies. The results presented in Figure14(b) further demonstrate that LDMS exhibits the smallest variance in reconstruction loss throughout the training process, which demonstrates that SmartGuardlearns both easy-to-learn behaviors and hard-to-learn behaviors very well. We also plotted the loss distribution diagram under different mask strategies. As shown in Figure15, LDMS shows the smallest reconstruction loss and variance, which demonstrates that our mask strategy can better learn hard-to-learn behaviors. We can still observe behaviors with high reconstruction loss as pointed by the red dashed arrow after applying LDMS, which is likely to be noise behaviors, thus it’s necessary to assign small weights for these noise behaviors during anomaly detection for avoiding identifying normal sequences containing noise behaviors as abnormal.