Anomalous IoT Behavior Detection Based on SARIMA Reference Waveform
Ryusei Eda, Nozomu Togawa · 2025
With the recent spread of Internet of Things (IoT) devices, security issues for hardware devices have been increasing. There are several methods proposed for analyzing power consumption of hardware devices to detect anomalous behavior of such devices. SARIMA is used to analyze steady-state time-series data, that is considered quite effective for detecting anomalous behavior of IoT devises. In this paper, we propose a method for detecting anomalous behavior of IoT devices based on a reference waveform using SARIMA. The proposed method extracts application power waveforms from measured power waveforms using the autoencoder. Then, a reference waveform is generated from the obtained application power waveforms using SARIMA, and compared to detect anomalous behaviors. We applied the proposed method to an IoT device implemented using the Raspberry Pi4, and succeeded in detecting anomalous behaviors by generating a highly accurate reference waveform using SARIMA, while the state-of-the-art recent method cannot detect them.