IoT-CAD: Context-Aware Adaptive Anomaly Detection in IoT

Systems Through Sensor Association

Rozhin Yasaei, Felix Hernandez, Mohammad Abdullah Al Faruque
Department of Electrical Engineering and Computer Science
University of California, Irvine, California, USA
{ryasaei,felixh1,alfaruqu}@uci.edu

ABSTRACT Closed-loop Control System Monitoring System

The deployment of Internet of Things (IoT) devices in cyber-physical

Sensor Controller Actuator Sensor User
applications has introduced a new set of vulnerabilities. The new
security and reliability challenges require a holistic solution due to
the cross-domain, cross-layer, and interdisciplinary nature of IoT
systems. However, the majority of works presented in the literature Environment Environment
Breaking Breaking
primarily focus on the cyber aspect, including the network and control loop control loop
: Attack : Fault
application layers, and the physical layer is often overlooked.
Figure 1: Two categories of IoT systems; (a) Closed-loop con-
In this paper, we utilize IoT sensors that capture the physical
trol system, and (b) Monitoring system.
properties of the system to ensure the integrity of IoT sensors data
and identify anomalous incidents in the environment. We propose physical layer of IoT as a cyber-physical system (CPS) is overlooked.
an adaptive context-aware anomaly detection method that is op- To ensure the security of CPS systems, in addition to a bottom-up
timized to run on a fog computing platform. In this approach, we security attitude, a holistic approach is required [8–10, 12].
devise a novel sensor association algorithm that generates finger- The ultimate goal of an IoT system is to control the environment
prints of sensors, clusters them, and extracts the context of the and maintain it in the desired state. In order to explain the important
system. Based on the contextual information, our predictor model, role of sensors in fulfilling this goal, we categorize IoT systems
which comprises an Long-Short Term Memory (LSTM) neural net- under two categories, as depicted in Figure 1: (i) a closed-loop control
work and Gaussian estimator, detects anomalies, and a consensus system, and (ii) a monitoring system. On the one hand, a closed-loop
algorithm identifies the source of the anomaly. Furthermore, our control system consists of three major components: (i) sensors; (ii)
model updates itself to adapt to the variation in the environment controller; and (iii) actuators (see Figure 1(a)). The sensors monitor
and system. The results demonstrate that our model detects the the system and send the status to the controller, which processes the
anomaly with 92.0% precision in 532ms, which meets the real-time sensor readings, decides how to react, and sends the control signals
constraint of the system under test. to the actuators to maintain the state of system and environment.
CCS CONCEPTS On the other hand, monitoring systems mainly contain sensors
that measure numerous parameters in the system and provide the
• Computer systems organization → Embedded and cyber-
user with information to take proper action (see Figure 1(b)). Al-
physical systems.
though a monitoring system cannot directly manipulate the envi-
KEYWORDS ronment, it informs a supervising user of events that happen in
the system, and the user controls the system manually. Thus, a
Internet of Things, context, sensor association, anomaly detection, monitoring system is eventually a part of a control loop.
recurrent neural networks, LSTM encoder-decoder In both categories, sensors are an essential component of the
1 INTRODUCTION control loop since sensor measurements determine the action that
Over the last decade, IoT has grabbed substantial attention due to is needed to maintain the system in the desired state. Malfunction
advancements in computation and communication, and it is utilized or manipulation of a sensor can break the control loop [4], and
in many applications such as smart home, automotive, and medical consequently, disrupt the services offered by the IoT system. Fault
aid. The rapid growth of IoT has raised concerns about the security in a sensor device leads to the appearance of anomalous values in
and reliability of these systems. There are a tremendous amount its readings, whereas not all anomalies in sensor measurements
of work in the literature that focuses on various aspects of IoT indicate sensor breakage because an unexpected event in the en-
systems such as communication network [24, 38], hardware security vironment may cause an anomaly as well. Observing the possible
[5, 15, 21, 22] or software security [3, 34, 40, 41]. However, the anomalies in an IoT system, we present a classification of anomalies
Permission to make digital or hard copies of part or all of this work for personal or
which facilitates identification of the anomaly’s source:
classroom use is granted without fee provided that copies are not made or distributed • Environmental Anomaly (EA): The environment is the
for profit or commercial advantage and that copies bear this notice and the full citation
on the first page. Copyrights for third-party components of this work must be honored. area that surrounds the sensor, and the sensor measures
For all other uses, contact the owner/author(s). its physical properties. Any anomaly in the environment
ICCAD ’20, November 2–5, 2020, Virtual Event, USA affects the measurements of the sensor and disrupts it. An
© 2020 Copyright held by the owner/author(s).
EA may occur as a result of malicious activities or unexpected
ACM ISBN 978-1-6654-2324-3/20/11. . . $15.00
https://doi.org/10.1145/3400302.3415672 incidents in the environment.
 Nitrate sensor Oxygen sensor Ammonia sensor Trendline (moving average)

PLC Controller

Water Changes in trendlines follow similar patterns Changes in trendlines follow similar patterns Anomalous changes
Source are only observed in
Anomalous
Oxygen changes still nitrate sensor
Water Sensor follow the
Tank Nitrate pattern
Sensor
Ammonia Changes in trendlines follow similar patterns Changes in trendlines follow similar patterns
Pump Valve Sensor

Blower
Time Time
(a) Wastewater plant (b) Sensors signal in the case of EA (c) Sensor signals in the case of SDA
Figure 2: (a) Schema of wastewater plant, and synthetic sensors’ signals in the (b) first scenario (EA), (c) second scenario (SDA).
• Sensing Device Anomaly (SDA): When the operation of in the water. The actuators, such as blowers and valves, are con-
a sensor is corrupted, its measurements do not follow the trolled by a Programmable Logic Controller to adjust the level of
same pattern, and an SDA is observed. This corruption occurs chemicals (Figure 2(a)). Given the importance of the nitrate level,
because of either security or reliability issues. For instance, anomaly detection is applied to detect abnormal changes. Consider
[1, 45] discuss some attacks on the physical layer. two scenarios with anomalous rise in nitrate level; In the first sce-
Current anomaly detection methods model the normal behavior nario, environmental changes alter the water temperature, which
of a device [7, 13, 31, 33] and label any deviation from expected affects the chemical reactions in the water tank (Figure 2(b), an
behavior as an anomaly. Most of the works concentrate on anomaly example of EA). In the second scenario, the nitrate sensor is broken
detection in the network layer of IoT systems [20]. In spite of rea- or manipulated by an attacker. (Figure 2(c), an example of SDA). The
sonable performance in network intrusion detection, these methods current anomaly detection methods rely solely on nitrate sensor
have a high rate of false alarms when used with sensor signals. They data, whereas the validity of its data is questionable. Thus, they can
misinterpret the environmental variation in the sensors measure- not find the source of anomaly and discriminate EA and SDA.
ments as an SDA and disregard the potential information encoded A recent study [14] analyzes the sensors of this wastewater plant
in the relation between the system and the physical world, known and reveals the correlation between ammonia, oxygen, and nitrate
as the context of the system (refer to Sec. 3.1 for the definition of sensor data. More specifically, when the rise in oxygen density
context). Conventionally, context-aware methods are applied to a reaches a certain threshold, the ammonia concentration decreases,
variety of applications [2], and recently, these methods are used to and the nitrate concentration increases. Further investigation re-
secure the authentication of co-located devices [16, 35, 36, 42]. veals the scientific rationale for this correlation; oxygen triggers
In this work, we propose an adaptive data-driven model the chemical reaction, which affects the ammonia and nitrate con-
for unsupervised anomaly detection in IoT systems based on centration. By considering this relationship, it is possible to validate
the sensor measurements. The model monitors the system sensor signals. In the first scenario, the incident affects all sensors.
to detect anomalies, identifies the type of anomaly (SDA or Despite irregularities in the sensor signals, they are consistent with
EA), and locates them. To this end, we develop an algorithm to each other. Thus, we can conclude that the integrity of the sensors’
extract the patterns in sensor signals and generate the context of data is not compromised. In the second scenario, the anomaly in
system. Then, we associate the sensors from different modalities the nitrate sensor data is inconsistent with the patterns of other
based on the context and cluster the sensors with similar behavior. sensor signals. It indicates that the cause of the abnormality is fault
We develop our customized Recurrent Neural Network (RNN), fol- or attack. This type of relationship between sensors in not limited
lowed by a consensus algorithm to detect and localize anomalies. to this wastewater plant and it is observed in many IoT systems
The consensus algorithm checks the consistency between sensors due to the availability of many heterogeneous sensors.
in each cluster and determines the type of anomaly. An IoT system 1.2 Threat Model
has a dynamic structure that is open to changes, such as adding The proposed methodology aims to detect SDA and EA, which occur
new nodes, removing the existing ones, or updating the framework due to an unexpected incident in the environment, reliability issue,
and protocols. In order to address the variation in IoT systems over or security breakage. Accidental damage, degradation, and defects
time, our model is designed to be adaptive and update itself. are examples of plausible reliability problems that cause unintended
1.1 Motivational Example device malfunctions. In contrast, the security breakage scenario
As a real-world IoT system, we study the environmental training involves an attacker who intentionally exploits the vulnerabilities
center wastewater plant in Riccione [14]. The primary purposes of in the system. In this threat model, the adversary has access to the
wastewater treatment is the elimination of nitrate. Nitrate contam- sensor device and fiddles with it to inject fault, alter functionality,
ination is a severe environmental problem because it can exhibit or deny its service. As another possible scenario, the attacker can
toxicity toward aquatic life, present a public health hazard, and control the communication channel and send faulty signal to the
affect the suitability of wastewater. In the treatment process, the controller as sensor measurements. The model can detect anomalies
wastewater is pumped to the tanks, which are equipped with sen- in a standalone sensor, but to distinguish between SDA and EA in
sors to monitor the concentration of oxygen, ammonia, and nitrate a sensor, it should be associated with at least two other sensors. To
deceive this method, the attacker should be able to discover how
sensors are clustered, learn the correlations and patterns in the
sensors’ signals, and manipulate them in a way that imitates the Cluster C1

same correlation as before. It means that in addition to sensors, the Fingerprint Sensor Cluster C2
Sensors Data Generation Clustering

…
attacker should have full access to the clustering layout of sensors
Cluster Cg
and the trained anomaly detection model. It is assumed that the Gaussian Predictive Each cluster
attacker does not have these privileges. Estimator Model
1.3 Research Challenges
Anomaly detection in the IoT sensors is challenging due to the
following reasons [11]: Use new data for retraining NO
• The IoT data are multi-variant time-series data that are col- Predictive Gaussian Anomaly
lected from a heterogeneous network of sensors with differ- Sensors Data Model Estimator Detection
ent modalities, data dimensions, sampling rates, specifica-
tions, and locations. Report Consensus YES
anomaly and Algorithm
• Low cost and resource-constrained sensors are usually sensi- its source
tive to noise, and deployment of them in IoT systems affects
: Retraining
the quality of data. : Module
: Data

• Due to lack of prior knowledge about possible anomalies and

Figure 3: The architecture of our methodology in the train-
scarcity of anomalous observations, there is not enough la-
ing and inference stage.
beled anomalous data available, and conventional supervised
machine learning technique are not applicable. sequences and reproduces them to predict future measurements.
• IoT systems have dynamic characteristics that may be al- Afterward, the predictions are compared with the new observations
tered over time because of environmental changes, human to spot deviations from expected normal behavior. Recurrent Neural
interaction, mobility of devices, and updating firmware or Networks (RNN) are capable of capturing the relationship between
software. Consequently, a static model fails to imitate the measurements over time because the feedback loops in the hidden
system in the long-term. layer of RNN can imitate memory.
Long-Short Term Memory (LSTM) layer was introduced in 1997
1.4 Our Contributions by [19] to overcome the shortcomings of RNN. It has gained a lot of
To the best of our knowledge, this is the first context-aware anom- attention lately because of its high accuracy in sequence prediction
aly detection method for IoT systems. Our novel contributions to [7, 31, 33]. Conv-LSTM encoder-decoder is one of the neural net-
address the aforementioned challenges are summarized below: work architectures that is used in the literature to enhance sequence
• Context-aware sensor association algorithm: We develop prediction performance [23, 25, 27, 43, 44]. It contains convolutional
a multi-modality clustering method to associate sensors that layers to extract the essential features of input sequences and LSTM
experience similar contextual variation. layers to perform the sequence prediction based on the features.
• Consensus-based strategy for unsupervised anomaly Then, the anomaly is identified based on the reconstruction error
detection: We design a methodology to pinpoint the anom- of the model. LSTM-LSTM encoder-decoder [32, 37, 46] is another
alies without reliance on prior knowledge about possible popular architecture which follows a similar strategy but it utilize
anomalies. LSTM layers instead of convolutional layers for feature extraction.
• Adaptive data-driven model: Our proposed anomaly de- Our methodology inherent the advantages of both probabilistic
tection model is periodically updated at run-time to adapt and predictive methods. We implement and compare the Conv-
itself to new states caused by variations in the system. LSTM and LSTM-LSTM encoder-decoder as our predictive models.
Then, the reconstruction error, derived from the difference between
2 RELATED WORKS real and predicted values, is modeled by a Multivariate Gaussian
General anomaly detection algorithms can be classified into the Estimators to detect the anomaly.
following main categories [14]:
Statistical or Probabilistic Methods: These methods create
3 ANOMALY DETECTION METHODOLOGY
a statistical or probabilistic model based on history data, which Our proposed methodology (see Figure 3) detects SDA and EA in an
represents normal behavior [17, 39]. Upcoming observation is then IoT system to ensure sensing devices operate as they are expected.
compared with this model, and it is marked as an anomaly if it is 3.1 Context Generation
statistically unlikely, or the probability of such observation is low. The context of a system is defined as an abstraction formed by ex-
Proximity Methods: These methods compute distances be- tracting features from system circumstances and individual element
tween data points to differentiate between anomalous and normal constructs[26]. It describes the condition in which the system is
data. Two well-known techniques that fall in this category are the operating and affects the outcome of the system. The first step
Local Outlier Factor [6] and clustering [18] methods. for obtaining our context-aware data-driven model is to generate
Predictive Methods: In these methods, the anomaly detection the context of the system by encoding its physical properties. Un-
problem is converted to obtaining an accurate sequence prediction derstanding and transforming this information such that it can be
algorithm that captures the recent and long-term trends in data mathematically described is called context generation. Following
 After sensor association, we evaluate the system to ensure that

Time Series Signals

Dense Layer (100)

there is no standalone sensor which is not clustered. A standalone

Min-Max Scaler

LSTM Decoder
LSTM Encoder

Dropout (0.5)

Output Layer
sensor is vulnerable because it is not related to any group of sensors

Encoded
States
that can verify its proper operation. In this case, the anomaly detec-
tion still can be applied to the independent sensor individually, but
the SDA and EA are indistinguishable. The user is warned about
this vulnerability in sensors and can resolve the issue by adding
more sensors to the system.
Figure 6: The architecture of RNN used as predictive model.
Algorithm 1: Customized clustering algorithm for extract-
ing patterns in sensor fingerprints and sensor association. multi-modality sensors with different signal ranges. Eventually, we
have a set of predictive models 𝐷𝑇 = {𝑀1, 𝑀2, . . . , 𝑀𝑔 } where 𝑔 is
Input: Fingerprints: 𝐹 ∈ 𝐼𝑅𝑛×𝑘 , number of sensors: 𝑛, the number of clusters in the system and 𝑀𝑖 represents the model
sub-sequence length: 𝑙, overlap: 𝑜 for cluster 𝑐𝑖 . Given cluster 𝑐𝑖 that contains 𝑛𝑖 nodes, the model
Output: Cluster layout 𝐶 = {𝑐 1, 𝑐 2, . . . , 𝑐𝑔 } 𝑀𝑖 takes as input a matrix 𝑋𝑖 ∈ R𝑙𝑖 ×𝑛𝑖 to predict another matrix
Initialize 𝑑 = 𝑘−𝑜
𝑙−𝑜 𝑌𝑖 ∈ R𝑛𝑖 ×𝑙𝑜 . On top of predictive models, Multivariate Gaussian
Initialize 𝑝𝑚𝑎𝑥 = max # of patterns in sub-sequence Estimators are trained to learn the probability of finding a par-
Initialize 𝑖𝑡𝑒𝑟𝑚𝑎𝑥 = max # of iterations ticular error vector. This probability is used to ascertain whether
Initialize the center of clusters randomly the errors between predictions and real measurements correspond
foreach 𝑗 ∈ {1, 2, . . . , 𝑑 } do to the system’s normal behavior, or an anomaly has occurred. A
foreach 𝑖 ∈ {1, 2, . . . , 𝑛} do multivariate Gaussian distributor 𝐺𝑖 = N (𝜇𝑖 , 𝜎𝑖 ) is fitted on the
Split fingerprint 𝐹𝑖 to obtain sub-sequences 𝑓𝑖 𝑗 ; reconstruction error matrix 𝐸𝑖 , which is the difference between
Clustering: the real values and predicted values. The parameters 𝜇𝑖 and 𝜎𝑖 are
foreach 𝑖𝑡𝑒𝑟 ∈ {1, 2, . . . , 𝑖𝑡𝑒𝑟𝑚𝑎𝑥 } do computed using Maximum Likelihood Estimation.
foreach 𝑖 ∈ {1, 2, . . . , 𝑛} do 𝑚 𝑚
𝑗 𝑗
𝑝𝑖 = 𝐴𝑟𝑔𝑚𝑖𝑛𝑥 ∈𝐶 𝐻𝑎𝑚𝑚𝑖𝑛𝑔(𝑓𝑖 , 𝑐𝑒𝑛𝑡𝑒𝑟 (𝑥)); 1 Õ 𝑘 1 Õ 𝑘
𝜇𝑖 = 𝑒𝑖 𝑗 = 𝑒 𝑖 𝑗 , 𝜎𝑖 = (𝑒 𝑗 − 𝜇 𝑗 )(𝑒 𝑘𝑗 − 𝜇 𝑗 )𝑇
𝑚 𝑚
foreach 𝑥 ∈ {1, 2, . . . , 𝑝𝑚𝑎𝑥 } do 𝑘=1 𝑘=1
𝑗 𝑗
𝑐𝑒𝑛𝑡𝑒𝑟 (𝑥) = 𝑚𝑒𝑎𝑛({𝑓𝑖 |𝑝𝑖 = 𝑥 });
3.4 Anomaly Detection
if no changes in 𝑐𝑒𝑛𝑡𝑒𝑟 (𝑥) then In the training stage, the predictive models and estimator modules
break;
are periodically used at run-time to infer anomalies. The frequency
foreach 𝑥 ∈ {1, 2, . . . , 𝑝𝑚𝑎𝑥 } do in which anomaly detection is performed can vary depending on
Calculate inter-cluster (𝑂𝐶) metrics; the system specifications. At the run-time, an input measurement
𝑗 𝑗
if 𝐻𝑎𝑚𝑚𝑖𝑛𝑔(𝐹𝑖 , 𝑐𝑒𝑛𝑡𝑒𝑟 (𝑝𝑖 ) > 𝑂𝐶 then 𝑥 𝑡 is compared with model prediction 𝑦𝑡 , and the reconstruction
𝑗 𝑗
Remove 𝐹𝑖 from cluster 𝑝𝑖 ; error 𝑒 𝑡 is calculated. Then, 𝑥 𝑡 classified as anomalous if 𝑝 𝑡 < 𝛼,
𝑗
Add 𝐹𝑖 in unclustered nodes; where 𝑝 𝑡 is the probability of obtaining the error vector given by
𝑗 the Gaussian estimator 𝐺. 𝛼 is a predefined threshold value, and it
Update 𝑝𝑚𝑎𝑥 ;
is tuned to maximize the F-score of the model.
if |𝑐𝑖 | < 3 then When anomalous data is discovered, we utilize our consensus
Remove cluster 𝑥;
𝑗 algorithm to differentiate between EA and SDA. EA occurs as a
Update 𝑝𝑚𝑎𝑥 ;
result of an incident in the environment. If the EA causes an anom-
Add clusters to pattern histories 𝑃𝑖 ; aly in a sensor signal, the correlated sensors are affected by the
Perform the clustering again on pattern histories 𝑃𝑖 , event and show abnormal changes in their signals. In contrast, SDA
𝑖 ∈ [1, 𝑛] to associate sensors; influences the sensors individually and results in an anomaly in one
return Sensors Cluster layout 𝐶 = {𝑐 1, . . . , 𝑐𝑔 } or some of the sensors in a cluster. For each cluster, the consensus
algorithm inspects the consistency of the sensor behaviors. It uses
3.3 Predictive Model a voting mechanism to check if all sensors in a cluster agree on the
The next module of our methodology is the predictive model that occurrence of an environmental incident. To account for inertia
predicts the future measurements of sensors according to the clus- in the physics of the system, we check the consensus in the time
tering layout and history of measurements. We construct a Re- intervals instead of data points.
current Neural Networks (RNN) for each cluster of sensors as the
predictive model. As it is depicted in 6, our RNN comprises LSTM 3.5 Model Adaptation
encoder-decoder and dense layers, which encode the features of in- Due to the high variation in the IoT system and environment, we
put sequences of length 𝑙𝑖 and predict the future sequences of length add the property of aliveness to our method, which means the
𝑙𝑜 based on the encoded features. Sequences of data are derived from model automatically gets updated to adapt to the system alteration
the input time-series signals using the sliding window technique. and make more accurate predictions. As Figure 3 demonstrates, the
Afterward, the sequences are scaled through a Min-Max Scaler be- sensor association, predictive model, and estimator modules are
fore being treated by the encoder because input signals come from trainable. There are two levels of updating the model; i)complete
update, which retrains all trainable modules in order, and ii) partial
update, which only retrains the predictor model. These update
processes are triggered under three circumstances:
• Change in the number of sensors in the system (either added
or removed) triggers complete update.
• Each time the sensors send data, the anomaly detection
model first validates the new data. Afterward, partial up-
date is triggered using the new anomaly-free data.
• If complete update is not provoked during a fixed interval
of time 𝑡𝑟𝑒𝑡𝑟𝑎𝑖𝑛 , it is triggered automatically. This way, the
model accounts for changes in the environment, location,
and placement. This parameter 𝑡𝑟𝑒𝑡𝑟𝑎𝑖𝑛 can be tuned by the
user, depending on how frequently the system layout is
changed.

4 RESULTS AND EVALUATION

4.1 Fog Computing Architecture
Cloud servers are the common and potent available computation
resource in IoT systems. However, the bandwidth of network and
Figure 8: The scaled-down version of experimental setup.
data transmission become a bottleneck due to Rapid expansion of
IoT nodes and the quantity of data. As a result, fog computing has
4.2 Experimental Setup
emerged, which provides storage, computation, and application
services closer to end-user with dense geographical distribution To build and evaluate our methodology, we implement an IoT
[29]. In the fog architecture (Figure 7), the bottom layer comprises a testbed in our laboratory. Our experimental setup consists of an
heterogeneous network of edge nodes with limited resources. The Ad-Hoc network of multi-modality IoT sensors, a Software-Defined
fog nodes in the middle layer collect and process the data from edge Radio (SDR) connected to an edge computing device, a gateway,
devices and communicate to the cloud via the internet. and a laptop as fog node . For this particular research, we have used
Our methodology is fog-empowered, and the developed model 62 sensors which measure 13 different physical parameters (see
for our target IoT system is implemented on a fog node. For the Table 1). The acoustic sensor is a wide range microphone with two
IoT systems with a high density of devices and a massive volume right and left channels that captures the sound of the space and its
of data, our method is scalable, and it still supports fog computing. output is amplified and recorded by the handy recorder ZOOM-H6.
Basically, the LSTM encoder-decoder networks are responsible for The raspberry pi board, which is directly connected to ZOOM-H6,
most of the computation in our method. Thus, instead of training an collects its data and transmits it over the Internet and this part of
extensive network for the whole system, we construct a small net- the system simulates devices such as Google Home or Alexa. The
work for each cluster of associated sensors that can be distributed other sensors are on the low-power embedded boards operated by
between fog nodes. Furthermore, we perform several optimizations TinyOS which are equipped with a wireless communication module
to meet resource constraints. In the sensor association, we use the based on IEEE 802.15.4 standard. We have implemented the IEEE
binary fingerprint instead of time-series signals, which lowers stor- 802.15.4 standard in the SDR device (USRP-B210) and created a
age usage and complicity. The sliding window technique in LSTM
network contributes to reducing storage usage as well. Table 1: List of sensors in our experimental setup.
Sensor Sensor board # of sensors
Temperature MTS-CM5000 12
Cloud

Humidity MTS-CM5000 12
Visible light MTS-CM5000 12
Infrared light MTS-CM5000 12
Force and load MTS-CO1000 2
Tilt MTS-CO1000 2
Fog

Accelerometer MTS-CO1000 2
Presence detector MTS-SE1000 2
Magnetic MTS-SE1000 1
CO_2 MTS-AR1000 1
Edge

CO MTS-AR1000 1
Dust MTS-SH3000 1
Acoustic ZOOM-H6 2

Figure 7: Fog computing hierarchy in IoT systems.

 Table 2: Comparison with the state-of-art methods
wireless network of sensors in which SDR collects the sensor’s data Base Context 𝐹 0.5 𝐹1
Method Precision Recall
Model Aware score score
and send commands to them. SDR is connected to an edge comput-
IoT-CAD LSTM Yes %92 %56 %81 %70
ing device, a raspberry pi board, which works as a base station and [31] LSTM No %64 %44 %58 %52
gathers all data. The base station contains a Wi-Fi module and links [28] Conv LSTM No %51 %95 %56 %66
the local network of IoT devices to the Internet through a router. [30] One Class SVM No %89 %25 %60 %39
It provides the system with the capability to be monitored in any
device which is connected to the internet by looking up the base indicate that this strategy is capable of finding relations between
station and logging using the password. The algorithms and anom- sensors with similar contextual variations, further confirmed by
aly detection model are implemented on a Laptop with 8Gb DDR4 the anomaly detection results in the next section.
RAM, and the Intel(R)Core(TM) i5-6300HQ 2.3GHz processor which 4.3.2 Anomaly Detection Evaluation. The anomaly detection
receives the data from base station and do the computations as a model is unsupervised and it is trained only on the normal data
fog node in the IoT system. A powerful router such as Qotom Mini and evaluated using a validation dataset with synthetic anomalies.
PC Q500G6 has similar capabilities and is capable of running the To analyze the results, True Positives (TP), False Positives (FP),
model at the gateway level. Figure 8 demonstrates the components and False Negatives (FN ) are counted in the results to compute the
of our experimental setup and their connections. validation scores. Although the most intuitive performance measure
4.3 Evaluation is accuracy, which is the ratio of correctly predicted observation
to the observations, it is not appropriate for unbalanced datasets
We evaluate our methodology using the data collected by the sensor such as anomaly detection where one category representing the
layout of Section 4.2. overwhelming majority of the data points. Therefore, we use the
4.3.1 Sensor Association Evaluation. One of the contributions Precision(P), Recall(R) and 𝐹 𝛽 𝑠𝑐𝑜𝑟𝑒 as performance metrics.
of our clustering algorithm is the capability to automatically tune
𝑇𝑃 𝑇𝑃 𝑃 × 𝑅 × (1 + 𝛽 2 )
the number of clusters and remove the ones which lack a sufficient 𝑃= ,𝑅 = , 𝐹 𝛽 𝑠𝑐𝑜𝑟𝑒 =
𝑇𝑃 + 𝐹𝑃 𝑇𝑃 + 𝐹𝑁 𝛽2 × 𝑃 + 𝑅
number of sensors or have sensors that are far apart regarding the
hamming distance between their fingerprints. Initially, we set the Recall expresses the ability to find all anomalous observation in a
number of clusters to 20 in our system under test, and the algo- dataset while precision expresses the proportion of the observations
rithm reduces the number to 6. In order to assess the performance of our model labels as anomaly, actually is anomalous. 𝐹 𝛽 𝑠𝑐𝑜𝑟𝑒 is
sensor association method, Inter-cluster and Intra-cluster distances the weighted average of precision and recall which provides a
are calculated for all clusters and plotted in Figure 9. The notable better intuition toward both key important capability of model. We
difference between inter-cluster distance and the intra-cluster dis- implement the current state-of-art methods for anomaly detection
tance indicates that related sensors are clustered together, and the in time-series data. Due to importance of precision, 𝐹 0.5 𝑠𝑐𝑜𝑟𝑒 which
clusters are well separated from each other. favors precision over recall is calculated for evaluation in addition
Another validation method used is physical intuition, which to 𝐹 1 𝑠𝑐𝑜𝑟𝑒. According to the results in Table 2, our methodology
explains the relationships among the associated sensors. For ex- has the best performance with highest 𝐹 𝑠𝑐𝑜𝑟𝑒𝑠 and precision.
ample, co-located sensors experience a similar context. Therefore, 4.4 Robustness
they are expected to be associated with each other. This intuition
We evaluate the robustness of our methodology by adding three
supports the result of our algorithm in which co-located humidity,
different types -pink, Gaussian, and uniform- of noise signals to the
temperature, and light sensors are clustered together, as it is shown
sensor measurements and observing the performance of the model.
in Figure 11. Another intuition behind the fact is that any physical
As Figure 10 indicates, although the precision of anomaly detection
process may have multi-modality emissions, and the sensors which
is decreased as the noise power increases in all models, our model
capture the emission of one incident should be clustered together.
is more resilient to noise and maintains the high precision.
It explains the clustering of PIR, vibration sensor (accelerometer
and force), magnetic door switch, and acoustic sensor since they all 95
capture the event of entrance through the door. These observations
Precision of anomaly detection (%)

Significant
0.6 85
precision drop
Resilient
0.5 75
to noise
0.4
Distance

65
Highly
sensitive
0.3 55
to noise
0.2 45

0.1 35
0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 2.5 3 5
Noise energy (Watt/Hz)
0 LSTM - Guassian noise LSTM - Pink noise LSTM - Uniform noise
Cluter1 Cluter2 Cluster3 Cluster4 Cluster5 Cluster6 All ConvLSTM - Guassian noise ConvLSTM - Pink noise ConvLSTM - Uniform noise
IoT-CAD - Guassian noise IoT-CAD - Pink noise IoT-CAD - Uniform noise
Inter-cluster distance Intra-cluster distance clusters
Figure 9: The inter-cluster and intra-cluster distances of sen- Figure 10: Evaluating the resilience of different models to
sor clusters. pink, Gaussian, and uniform noise signals.
REFERENCES [23] Tao Lin, Tian Guo, and Karl Aberer. 2017. Hybrid Neural Networks for Learning
[1] M. M. Ahemd, M. A. Shah, and A. Wahid. 2017. IoT security: A layered ap- the Trend in Time Series. (2017), 2273–2279. https://doi.org/10.24963/ijcai.2017/
proach for attacks amp; defenses. In 2017 International Conference on Commu- 316
nication Technologies (ComTech). 104–110. https://doi.org/10.1109/COMTECH. [24] Wei-Chao Lin, Shih-Wen Ke, and Chih-Fong Tsai. 2015. CANN: An intrusion
2017.8065757 detection system based on combining cluster centers and nearest neighbors.
[2] Unai Alegre, Juan Carlos Augusto, and Tony Clark. 2016. Engineering context- Knowledge-based systems 78 (2015), 13–21.
aware systems and applications: A survey. Journal of Systems and Software 117 [25] Y. Liu, H. Zheng, X. Feng, and Z. Chen. 2017. Short-term traffic flow prediction
(2016), 55–83. with Conv-LSTM. In 2017 9th International Conference on Wireless Communi-
[3] D. Altolini, V. Lakkundi, N. Bui, C. Tapparello, and M. Rossi. 2013. Low power cations and Signal Processing (WCSP). 1–6. https://doi.org/10.1109/WCSP.2017.
link layer security for IoT: Implementation and performance analysis. In 2013 8171119
9th International Wireless Communications and Mobile Computing Conference [26] Barthélémy Longueville, Mickaël Gardoni, et al. 2003. A survey of context
(IWCMC). 919–925. https://doi.org/10.1109/IWCMC.2013.6583680 modeling: approaches, theories and use for engineering design researches. In
[4] Anomadarshi Barua and Mohammad Al Faruque. 2020. Hall Spoofing: A Non- DS 31: Proceedings of ICED 03, the 14th International Conference on Engineering
Invasive DoS Attack on Grid-Tied Solar Inverter. 29th Usenix Security (2020). Design, Stockholm. 437–438.
[5] Ferdinand Brasser, Brahim El Mahjoub, Ahmad-Reza Sadeghi, Christian Wachs- [27] YANG Zhihong TU Mengfu LU Jinjun LU Jixiang, ZHANG Qipei and PENG Hui.
mann, and Patrick Koeberl. 2015. TyTAN: tiny trust anchor for tiny devices. In 2019. Short-term Load Forecasting Method Based on CNN-LSTM Hybrid Neural
2015 52nd ACM/EDAC/IEEE Design Automation Conference (DAC). IEEE, 1–6. Network Model. AEPS 43, 8 (2019), 131. https://doi.org/10.7500/AEPS20181012004
[6] Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. 2000. [28] W. Luo, W. Liu, and S. Gao. 2017. Remembering history with convolutional LSTM
LOF: identifying density-based local outliers. In ACM sigmod record, Vol. 29. ACM, for anomaly detection. In 2017 IEEE International Conference on Multimedia and
93–104. Expo (ICME). 439–444. https://doi.org/10.1109/ICME.2017.8019325
[7] Sucheta Chauhan and Lovekesh Vig. 2015. Anomaly detection in ECG time [29] Lingjuan Lyu, Jiong Jin, Sutharshan Rajasegarar, Xuanli He, and Marimuthu
signals via deep long short-term memory networks. In 2015 IEEE International Palaniswami. 2017. Fog-empowered anomaly detection in IoT using hyperellip-
Conference on Data Science and Advanced Analytics (DSAA). IEEE, 1–7. soidal clustering. Internet of Things Journal (2017).
[8] Hsin Chung Chen, Mohammad Abdullah Al Faruque, and Pai H Chou. 2016. [30] Junshui Ma and Simon Perkins. 2003. Time-series novelty detection using one-
Security and privacy challenges in IoT-based machine-to-machine collaborative class support vector machines. In International Joint Conference on Neural Net-
scenarios. In Proceedings of the Eleventh IEEE/ACM/IFIP International Conference works.
on Hardware/Software Codesign and System Synthesis. [31] Pankaj Malhotra, Anusha Ramakrishnan, Gaurangi Anand, Lovekesh Vig, Puneet
[9] Sujit Rokka Chhetri, Sina Faezi, Arquimedes Canedo, and Mohammad Abdul- Agarwal, and Gautam Shroff. 2016. LSTM-based encoder-decoder for multi-sensor
lah Al Faruque. 2019. QUILT: quality inference from living digital twins in anomaly detection. arXiv preprint arXiv:1607.00148 (2016).
IoT-enabled manufacturing systems. In Proceedings of the International Confer- [32] Pankaj Malhotra, Vishnu TV, Anusha Ramakrishnan, Gaurangi Anand, Lovekesh
ence on Internet of Things Design and Implementation. ACM, 237–248. Vig, Puneet Agarwal, and Gautam Shroff. 2016. Multi-Sensor Prognos-
[10] Sujit Rokka Chhetri, Nafiul Rashid, Sina Faezi, and Mohammad Abdullah tics using an Unsupervised Health Index based on LSTM Encoder-Decoder.
Al Faruque. 2017. Security trends and advances in manufacturing systems in arXiv:1608.06154 [cs.LG]
the era of industry 4.0. In IEEE/ACM International Conference on Computer-Aided [33] Pankaj Malhotra, Lovekesh Vig, Gautam Shroff, and Puneet Agarwal. 2015. Long
Design (ICCAD). short term memory networks for anomaly detection in time series. In Proceedings.
[11] Andrew Cook, Göksel Mısırlı, and Zhong Fan. 2019. Anomaly Detection for IoT Presses universitaires de Louvain, 89.
Time-Series Data: A Survey. Internet of Things Journal (2019). [34] Jonathan M McCune, Yanlin Li, Ning Qu, Zongwei Zhou, Anupam Datta, Vir-
[12] Sina Faezi, Sujit Rokka Chhetri, Arnav Vaibhav Malawade, John Charles Chaput, gil Gligor, and Adrian Perrig. 2010. TrustVisor: Efficient TCB reduction and
William H Grover, Philip Brisk, and Mohammad Abdullah Al Faruque. 2019. Oligo- attestation. In 2010 IEEE Symposium on Security and Privacy. IEEE, 143–158.
Snoop: A Non-Invasive Side Channel Attack Against DNA Synthesis Machines.. [35] Markus Miettinen, N Asokan, Thien Duc Nguyen, Ahmad-Reza Sadeghi, and
In NDSS. Majid Sobhani. 2014. Context-based zero-interaction pairing and key evolution
[13] Pavel Filonov, Andrey Lavrentyev, and Artem Vorontsov. 2016. Multivariate for advanced personal devices. In Proceedings of the 2014 ACM SIGSAC Conference
Industrial Time Series with Cyber-Attack Simulation: Fault Detection Using an on Computer and Communications Security. ACM, 880–891.
LSTM-based Predictive Data Model. arXiv:1612.06676 [cs.LG] [36] Markus Miettinen, Thien Duc Nguyen, Ahmad-Reza Sadeghi, and N Asokan. 2018.
[14] Federico Giannoni, Marco Mancini, and Federico Marinelli. 2018. Anomaly Revisiting context-based authentication in IoT. In 2018 55th ACM/ESDA/IEEE
Detection Models for IoT Time Series Data. arXiv (2018). Design Automation Conference (DAC). IEEE, 1–6.
[15] B. Halak, M. Zwolinski, and M. S. Mispan. 2016. Overview of PUF-based hardware [37] Yao Qin, Dongjin Song, Haifeng Chen, Wei Cheng, Guofei Jiang, and Garrison
security solutions for the internet of things. In 2016 IEEE 59th International Cottrell. 2017. A Dual-Stage Attention-Based Recurrent Neural Network for
Midwest Symposium on Circuits and Systems (MWSCAS). 1–4. https://doi.org/10. Time Series Prediction. arXiv:1704.02971 [cs.LG]
1109/MWSCAS.2016.7870046 [38] Shahid Raza, Linus Wallgren, and Thiemo Voigt. 2013. SVELTE: Real-time intru-
[16] Jun Han, Albert Jin Chung, Manal Kumar Sinha, Madhumitha Harishankar, Shijia sion detection in the Internet of Things. Ad hoc networks 11, 8 (2013), 2661–2674.
Pan, Hae Young Noh, Pei Zhang, and Patrick Tague. 2018. Do you feel what I [39] H. Sedjelmaci, S. M. Senouci, and M. Al-Bahri. 2016. A lightweight anomaly
hear? Enabling autonomous IoT device pairing using different sensor types. In detection technique for low-resource IoT devices: A game-theoretic methodology.
2018 IEEE Symposium on Security and Privacy (SP). IEEE, 836–852. In 2016 IEEE International Conference on Communications (ICC). 1–6. https:
[17] Mee Lan Han, Jin Lee, Ah Reum Kang, Sungwook Kang, Jung Kyu Park, and //doi.org/10.1109/ICC.2016.7510811
Huy Kang Kim. 2015. A Statistical-Based Anomaly Detection Method for Con- [40] Arvind Seshadri, Mark Luk, and Adrian Perrig. 2008. SAKE: Software Attestation
nected Cars in Internet of Things Environment. In Internet of Vehicles - Safe and for Key Establishment in Sensor Networks. In Distributed Computing in Sensor
Intelligent Mobility, Ching-Hsien Hsu, Feng Xia, Xingang Liu, and Shangguang Systems, Sotiris E. Nikoletseas, Bogdan S. Chlebus, David B. Johnson, and Bhaskar
Wang (Eds.). Springer International Publishing, Cham, 89–97. Krishnamachari (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 372–385.
[18] Zengyou He, Xiaofei Xu, and Shengchun Deng. 2003. Discovering cluster-based [41] Arvind Seshadri, Mark Luk, Adrian Perrig, Leendert van Doorn, and Pradeep K.
local outliers. Pattern Recognition Letters 24, 9-10 (2003), 1641–1650. Khosla. 2006. SCUBA: Secure Code Update By Attestation in sensor networks. In
[19] Sepp Hochreiter and Jürgen Schmidhuber. 1997. Long short-term memory. Neural Workshop on Wireless Security.
computation 9, 8 (1997), 1735–1780. [42] Jiang Wan, Anthony Lopez, and Mohammad Abdullah Al Faruque. 2018. Physical
[20] E. Hodo, X. Bellekens, A. Hamilton, P. Dubouilh, E. Iorkyase, C. Tachtatzis, layer key generation: Securing wireless communication in automotive cyber-
and R. Atkinson. 2016. Threat analysis of IoT networks using artificial neural physical systems. ACM Transactions on Cyber-Physical Systems 3, 2 (2018), 13.
network intrusion detection system. In 2016 International Symposium on Networks, [43] Yuankai Wu and Huachun Tan. 2016. Short-term traffic flow forecast-
Computers and Communications (ISNCC). 1–6. https://doi.org/10.1109/ISNCC. ing with spatial-temporal correlation in a hybrid deep learning framework.
2016.7746067 arXiv:1612.01022 [cs.CV]
[21] C. Lesjak, H. Bock, D. Hein, and M. Maritsch. 2016. Hardware-secured and [44] Haiyang Yu, Zhihai Wu, Shuqin Wang, Yunpeng Wang, and Xiaolei Ma. 2017.
transparent multi-stakeholder data exchange for industrial IoT. In 2016 IEEE Spatiotemporal Recurrent Convolutional Networks for Traffic Prediction in Trans-
14th International Conference on Industrial Informatics (INDIN). 706–713. https: portation Networks. Sensors 17, 7 (2017). https://doi.org/10.3390/s17071501
//doi.org/10.1109/INDIN.2016.7819251 [45] K. Zhao and L. Ge. 2013. A Survey on the Internet of Things Security. In 2013
[22] Christian Lesjak, Norbert Druml, Rainer Matischek, Thomas Ruprechter, and Ninth International Conference on Computational Intelligence and Security. 663–
Gerald Holweg. 2016. Security in industrial IoT – quo vadis? e & i Elektrotechnik 667. https://doi.org/10.1109/CIS.2013.145
und Informationstechnik 133, 7 (01 Nov 2016), 324–329. https://doi.org/10.1007/ [46] Z. Zhao, W. Chen, X. Wu, P. C. Y. Chen, and J. Liu. 2017. LSTM network: a deep
s00502-016-0428-4 learning approach for short-term traffic forecast. IET Intelligent Transport Systems
11, 2 (2017), 68–75. https://doi.org/10.1049/iet-its.2016.0208