# ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks

arXiv: https://arxiv.org/abs/2302.07589 · HTML: https://mlsanity.com/paper/2302.07589/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 56 references that are in the map.
- First posted on arXiv 15 Feb 2023.

## Builds on (most cited first, 9 of 9)

- [Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation](https://mlsanity.com/paper/1406.1078/) (2014)
- [D"IoT: A Federated Self-learning Anomaly Detection System for IoT](https://mlsanity.com/paper/1804.07474/) (2018)
- [Aegis: A Context-aware Security Framework for Smart Home Systems](https://mlsanity.com/paper/1910.03750/) (2019)
- [6thSense: A Context-aware Sensor-based Attack Detector for Smart Devices](https://mlsanity.com/paper/1706.10220/) (2017)
- [IoTGaze: IoT Security Enforcement via Wireless Context Analysis](https://mlsanity.com/paper/2006.15827/) (2020)
- [Soteria: Automated IoT Safety and Security Analysis](https://mlsanity.com/paper/1805.08876/) (2018)
- [Autoencoder-based Anomaly Detection in Smart Farming Ecosystem](https://mlsanity.com/paper/2111.00099/) (2021)
- [CIoTA: Collaborative IoT Anomaly Detection via Blockchain](https://mlsanity.com/paper/1803.03807/) (2018)
- [Towards Practical Integrity in the Smart Home with HomeEndorser](https://mlsanity.com/paper/2109.05139/) (2021)

## Built on by (most cited first, 6 of 6)

- [Applying Self-supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network](https://mlsanity.com/paper/2403.01501/) (2024)
- [Make Your Home Safe: Time-aware Unsupervised User Behavior Anomaly Detection in Smart Homes via Loss-guided Mask](https://mlsanity.com/paper/2406.10928/) (2024)
- [SmartBench: Evaluating LLMs in Smart Homes with Anomalous Device States and Behavioral Contexts](https://mlsanity.com/paper/2603.06636/) (2026)
- [Synthetic User Behavior Sequence Generation with Large Language Models for Smart Homes](https://mlsanity.com/paper/2501.19298/) (2025)
- [A Giant-Step Baby-Step Classifier For Scalable and Real-Time Anomaly Detection In Industrial Control Systems and Water Treatment Systems](https://mlsanity.com/paper/2504.20906/) (2025)
- [Semantic-aware Graph-guided Behavior Sequences Generation with Large Language Models for Smart Homes](https://mlsanity.com/paper/2508.03484/) (2025)

## Abstract (arXiv)

IoT application domains, device diversity and connectivity are rapidly growing. IoT devices control various functions in smart homes and buildings, smart cities, and smart factories, making these devices an attractive target for attackers. On the other hand, the large variability of different application scenarios and inherent heterogeneity of devices make it very challenging to reliably detect abnormal IoT device behaviors and distinguish these from benign behaviors. Existing approaches for detecting attacks are mostly limited to attacks directly compromising individual IoT devices, or, require predefined detection policies. They cannot detect attacks that utilize the control plane of the IoT system to trigger actions in an unintended/malicious context, e.g., opening a smart lock while the smart home residents are absent. In this paper, we tackle this problem and propose ARGUS, the first self-learning intrusion detection system for detecting contextual attacks on IoT environments, in which the attacker maliciously invokes IoT device actions to reach its goals. ARGUS monitors the contextual setting based on the state and actions of IoT devices in the environment. An unsupervised Deep Neural Network (DNN) is used for modeling the typical contextual device behavior and detecting actions taking place in abnormal contextual settings. This unsupervised approach ensures that ARGUS is not restricted to detecting previously known attacks but is also able to detect new attacks. We evaluated ARGUS on heterogeneous real-world smart-home settings and achieve at least an F1-Score of 99.64% for each setup, with a false positive rate (FPR) of at most 0.03%.