Device-Specific Anomaly Detection Models for IoT Systems

The Internet of Things (IoT) has transformed home automation, industry, and agriculture, yet security remains a major challenge. IoT systems comprise a wide range of devices generating vast and heterogeneous data. This paper investigates device-specific and device-type-specific anomaly detection models, highlighting the potential of leveraging unique traffic patterns from heterogeneous IoT devices. These models are compared to a single model trained on data from all devices, using eight different supervised and unsupervised One-Class Classifier (OCC) methods on two IoT-collected datasets.Typically, real-world IoT devices generate normal traffic prior to any attack or intrusion. With an abundance of normal traffic and no labelled attack data, unsupervised learning becomes a suitable approach. The findings of this paper show that when using unsupervised methods, device-specific and device-type-specific models outperform single models, particularly when the data is dominated by one class. In this context, device/device-type models can be more effective for real-time anomaly detection by identifying attacks as deviations from the normal profiles established for each device or device type.