ADIoT: An Anomaly Detection Model for IoT Devices Based on Behavioral Feature Analysis

The existing anomaly detection methods for IoT devices suffer from several limitations, including inadequate and untimely implementation of security control measures, as well as an inability to promptly mitigate intrusion behaviors. To address these issues, we propose an anomaly detection model for IoT devices based on behavioral feature analysis (ADIoT). The model implements two methods, specifically multidimensional behavior feature selection and anomaly detection. The first method uses the principal component analysis based on weighted contribution(WCPCA) to identify the most representative feature combination from a large number of features and generate a feature dataset that accurately reflects the device behavior patterns. The second method uses an anomaly detection method based on isolation forests to score and identify anomalies in behavioral data and dynamically adjust the anomaly detection threshold. Experimental results demonstrate that ADIoT achieves a detection accuracy of 98.6% on the TON dataset, outperforming state-of-the-art anomaly detection models. Additionally, ADIoT significantly improves time efficiency, reducing test times by 30.79% compared to SVM-based models and by 20.11% compared to CNN-based models.