Abstract

A smart home can accumulate more Internet connected devices than it can cover with security, and just one vulnerable surveillance camera or recorder can recruit the entire family into a botnet. Detecting that compromise in the cloud is possible, but is not well suited to the home: it sends traffic out of the house, adds a round trip to each decision, and fails if the up link is overloaded by the same attack it’s meant to defend. In this paper we consider a more focused, more tractable question: how good a detector can we operate behind a low cost gateway, and what is the time and memory cost? We tackle the problem with two complementary tree-based models without requiring a GPU or a cloud link. A Gradient Boosting ensemble makes classification decisions based on traffic from known attack families it has been trained with, while an Isolation Forest, trained with benign traffic alone, raises a flag when a flow is detected to be too different from the household’s normal traffic. The primary training and evaluation are done using N-BaIoT, which has nine real commercial devices infected by Mirai and Gafgyt, while portability probes are performed on CIC-IoT2023, TON-IoT and RTIoT2022. The combined detector has an F1 of over 0.98 on known attacks, makes a decision in 2 to 3 milliseconds per flow, and consumes only a few megabytes of disk space.