Physical Tells Digital Threats: Supervised ML-IDS for Multimodal IoT Telemetry in Smart Buildings

Traditional machine learning-based intrusion detection systems (ML-IDS) in smart building environments face critical limitations, including heavy reliance on network traffic analysis, high computational overhead, and inability to detect insider threats. The solution lies in recognizing that cyber attacks in smart buildings inevitably manifest as anomalies in physical device behaviors, such as temperature fluctuations, unexpected door activations, and abnormal HVAC operations, which traditional network-based IDS systems completely overlook. This paper presents a novel supervised ML-IDS that leverages multimodal IoT telemetry data, combining physical sensor readings with device operational states to detect cyber attacks. Using a dataset with 221,859 telemetry records from smart building infrastructure, we demonstrate that physical sensor data (temperature, motion, door states) combined with Modbus protocol communications provide superior attack detection capabilities. Our multimodal telemetry-based ML-IDS achieves 84.47 % accuracy and 90.76 % AUC for binary attack detection, significantly outperforming conventional IoT security approaches while operating with minimal computational requirements suitable for edge deployment. The system successfully detects seven distinct types of attack: backdoor, DDoS, injection, password, ransomware, scanning, and XSS attacks. selective classification detectors demonstrate exceptional performance for specific attacks, such as scanning (85.66 % AUC) and DDoS (<tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{8 4. 0 1 \%}$</tex> AUC). Our findings suggest that multimodal IoT telemetry data, particularly combined physical readings and device status indicators, provide sufficient discriminative features for effective cyber attack detection, including zero-day exploits and insider threats that manifest as anomalies in physical device behaviors.