# CADeSH: Collaborative Anomaly Detection for Smart Homes

arXiv: https://arxiv.org/abs/2303.01021 · HTML: https://mlsanity.com/paper/2303.01021/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 20 of its 101 references that are in the map.
- First posted on arXiv 2 Mar 2023.

## Builds on (most cited first, 20 of 20)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Federated Optimization: Distributed Machine Learning for On-Device Intelligence](https://mlsanity.com/paper/1610.02527/) (2016)
- [Federated Learning with Differential Privacy: Algorithms and Performance Analysis](https://mlsanity.com/paper/1911.00222/) (2019)
- [Federated Machine Learning: Concept and Applications](https://mlsanity.com/paper/1902.04885/) (2019)
- [Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning](https://mlsanity.com/paper/1804.00308/) (2018)
- [D"IoT: A Federated Self-learning Anomaly Detection System for IoT](https://mlsanity.com/paper/1804.07474/) (2018)
- [Privacy-preserving Traffic Flow Prediction: A Federated Learning Approach](https://mlsanity.com/paper/2003.08725/) (2020)
- [N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders](https://mlsanity.com/paper/1805.03409/) (2018)
- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Machine Learning DDoS Detection for Consumer Internet of Things Devices](https://mlsanity.com/paper/1804.04159/) (2018)
- [Federated Learning for Internet of Things: A Federated Learning Framework for On-device Anomaly Data Detection](https://mlsanity.com/paper/2106.07976/) (2021)
- [Distributed Anomaly Detection using Autoencoder Neural Networks in WSN for IoT](https://mlsanity.com/paper/1812.04872/) (2018)
- [Evaluating Federated Learning for Intrusion Detection in Internet of Things: Review and Challenges](https://mlsanity.com/paper/2108.00974/) (2021)
- [Lightweight Classification of IoT Malware based on Image Recognition](https://mlsanity.com/paper/1802.03714/) (2018)
- [Compressive K-means](https://mlsanity.com/paper/1610.08738/) (2016)
- [HADES-IoT: A Practical Host-Based Anomaly Detection System for IoT Devices (Extended Version)](https://mlsanity.com/paper/1905.01027/) (2019)
- [No NAT'd User left Behind: Fingerprinting Users behind NAT from NetFlow Records alone](https://mlsanity.com/paper/1402.1940/) (2014)
- [A Comparative Review Of Internet Protocol Version 4 (IPv4) and Internet Protocol Version 6 (IPv6)](https://mlsanity.com/paper/1407.2717/) (2014)
- [Anomalous Communications Detection in IoT Networks Using Sparse Autoencoders](https://mlsanity.com/paper/1912.11831/) (2019)

## Abstract (arXiv)

Although home IoT (Internet of Things) devices are typically plain and task oriented, the context of their daily use may affect their traffic patterns. For this reason, anomaly-based intrusion detection systems tend to suffer from a high false positive rate (FPR). To overcome this, we propose a two-step collaborative anomaly detection method which first uses an autoencoder to differentiate frequent (`benign') and infrequent (possibly `malicious') traffic flows. Clustering is then used to analyze only the infrequent flows and classify them as either known ('rare yet benign') or unknown (`malicious'). Our method is collaborative, in that (1) normal behaviors are characterized more robustly, as they take into account a variety of user interactions and network topologies, and (2) several features are computed based on a pool of identical devices rather than just the inspected device. We evaluated our method empirically, using 21 days of real-world traffic data that emanated from eight identical IoT devices deployed on various networks, one of which was located in our controlled lab where we implemented two popular IoT-related cyber-attacks. Our collaborative anomaly detection method achieved a macro-average area under the precision-recall curve of 0.841, an F1 score of 0.929, and an FPR of only 0.014. These promising results were obtained by using labeled traffic data from our lab as the test set, while training the models on the traffic of devices deployed outside the lab, and thus demonstrate a high level of generalizability. In addition to its high generalizability and promising performance, our proposed method also offers benefits such as privacy preservation, resource savings, and model poisoning mitigation. On top of that, as a contribution to the scientific community, our novel dataset is available online.