Anomaly Detection Based on Behavior Feature Correlation for IoT Systems

In Internet of Things (IoT) systems, automation rules are crucial for the intelligent control of devices. However, their reliance on event-driven logic is vulnerable to various security threats, such as event injection and command interception, which can disrupt system operations and compromise safety. Existing approaches typically extract state correlations from event sequences segmented by fixed time windows. These approaches struggle to identify long-range, multi-hop dependencies and can be bypassed by adversarial event sequences that partially mimic legitimate patterns, leading to false negatives. To address these, in this paper, we propose an anomaly detection method based on behavior feature correlation. Our approach models inter-device state correlations using a heterogeneous graph structure. It partitions behavior patterns through iterative community detection and automated semantic annotation, and represents normal behavior by embedding and clustering of state sequences. During the detection phase, anomalies are identified by measuring the similarity between the representation of a test sequence and the established benign profile. Experimental results demonstrate that our anomaly detection approach enhances precision by 1 time and recall by 3.2 times, compared to the leading baseline method.