The article proposes a statistical method for detecting anomalies in the network traffic of Internet of Things (IoT) devices, which does not require the use of machine learning methods or pre-training on labeled data. The concept of the approach is based on building a profile of the normal behavior of each device using a modified Z-index that uses the median and median absolute deviation (MAD) to increase the robustness to noise, outliers and traffic irregularities. Anomaly events are defined as those that fall outside the limits of statistically justified acceptable intervals. The method is supplemented with a mechanism for filtering insignificant deviations using weighting factors that take into account the influence of individual parameters on the overall behavior of the device. Additionally, exponential smoothing and a cumulative deviation index are used to detect both shortterm and long-term anomalies. The proposed approach provides high adaptability to changes in the network activity of IoT devices, does not require large computing resources and can be used in realtime in monitoring systems. The practical implementation of the method involves the generation of device activity logs with controlled anomalies, which allows assessing the accuracy and sensitivity of the algorithm. Various types of deviations were simulated, including changes in the frequency of messages, the number of connection errors, the intervals between messages and authorization attempts. The method showed the highest efficiency in detecting temporal anomalies, demonstrating an average accuracy of over 84%. Since the method does not depend on prior information about the types of attacks, it is particularly suitable for protecting dynamic and heterogeneous IoT infrastructures.
The world is rapidly entering the Internet of Things (IoT) era, with the number of connected devices expected to exceed 75 billion by 2025. At the same time, the massive expansion of IoT poses serious challenges to cybersecurity, with over 77.9 million attacks recorded in 2023, up 37% from 2022. Botnets such as Mirai and Mozi exploit vulnerable IoT devices to carry out DDoS attacks, data theft, and industrial espionage, threatening critical infrastructure. Traditional security methods cannot handle dynamic IoT traffic, which requires new algorithms for realtime threat detection.
This paper proposes a combined approach that combines statistical methods (modified Zscore, Rosner test, Holt-Winters method) with machine learning (Autoencoder) for effective anomaly detection. Experiments conducted on the generated IoT traffic logs demonstrate that this combination significantly reduces the level of false positives and ensures detection accuracy. The proposed approach allows to adapt the security system to the specificities of the IoT infrastructure and to operate stably even with limited resources.
The paper [
The key element of the study was the smart home experimental setup, which allowed
collecting IoT device traffic and creating the IoTTGen tool for traffic modeling and emulation.
The authors compared synthetic and real traffic and analyzed their entropy properties to assess
the impact of anomalies. The experimental results confirmed significant differences in traffic
behavior depending on the device type and scenario, which emphasizes the importance of the
entropy approach for anomaly detection. [
The authors [
In [
The principle of LSAD is to create signatures of protected traffic and determine a threshold
value T based on the average hash similarity. Comparing new flows with this threshold value
allows for effective anomaly detection. The effectiveness of LSAD was experimentally evaluated
on a set of 15 attack types (ARP Spoofing, Ping of Death, TCP SYN Flooding). The method
demonstrated a true positive rate of over 97% when analyzing one-minute traffic. Compared to
single-class ML models, LSAD demonstrated higher accuracy and minimal computational costs,
which makes it suitable for implementation in resource-constrained IoT systems. In addition,
the k-means algorithm was used to study the behavioral clustering of devices in the LoRaWAN
network. The analysis of over 997 thousand packets from 2169 devices allowed us to identify
five main clusters of network activity. The authors studied the difference between stable and
anomalous device behavior patterns. [
The authors in [
In the papers [
In the papers [11,12], the authors explore the use of deep learning (DL) methods to detect anomalies in IoT network traffic. They review state-of-the-art deep anomaly detection (DAD) approaches and implement an ensemble model based on the KDD Cup 99 dataset. The authors highlight the advantages of DL in discovering complex patterns in high-dimensional data, especially for IoT environments.[13]
The research methodology involves the use of various DL models such as GAN, CNN, LSTM, and AutoEncoder. Normalization, feature scaling, and hyperparameter selection methods were used for the experiments.[14] The main focus was on the interpretability of the models and their performance.
Experimental results showed that the CNN+LSTM ensemble model with Random Forest classifier achieved the highest accuracy of 98.22%, outperforming the other implemented models (AE and GAN). The ensemble also demonstrated the lowest false positive and false negative rates. The authors highlight the potential of combining DL models and ensemble approaches for efficient monitoring of IoT network traffic.[15]
The paper [16] presents a systematic mapping of research on anomaly detection in industrial equipment using IoT devices and machine learning (ML) algorithms.[16]
The focus is on three types of equipment: milling tools, hydraulic systems, and bearings, as they are the most prone to wear. The key sensors for anomaly detection were identified: vibration, temperature, current, and pressure sensors.[17,18] The effectiveness of a combined approach using multiple sensors to improve the detection accuracy is highlighted. The authors also reviewed common ML algorithms: neural networks (MLP, LSTM, CNN), outlier detection algorithms (OCSVM, Isolation Forest), and heuristic methods. It is noted that ensemble models and autoencoders in combination with data preprocessing (FFT, PCA, normalization) demonstrate the highest accuracy. Industry challenges are specifically addressed, including limited resources of edge devices, lack of outlier data, and the need to regularly retrain models to adapt to changes in manufacturing processes.[19]
In [14], the use of CNN, LSTM, and their combined CNN-LSTM neural networks for analyzing IoT device traffic and detecting attacks is investigated. The KDDCup99, NSL-KDD, UNSW-NB15, WSN-DS, and CCIoT2023 datasets were used to train the models, allowing us to test the effectiveness of the approach in various scenarios.[20,21]
The main problem noted by the authors is the heterogeneity of IoT networks, which complicates the global configuration of security systems. The proposed CNN-LSTM-based solution provides high accuracy, but the effectiveness of the method is highly dependent on the type of attack and device class, which may affect the detection results.[22]
The main drawback is the high computational complexity, which limits the possibility of implementing such systems in real IoT networks. This confirms the relevance of research in the direction of lightweight statistical methods that can ensure the effectiveness of risk identification without spending a lot of resources.[23]
The study presents an interesting solution for modeling a DDoS attack scenario on specialized information systems. The authors use a stochastic network model that allows them to estimate the potential capabilities of attackers, the time it takes to implement an attack, and its impact on critical resources [24]. The process of analyzing the parameters of the network environment, which includes the characteristics of the probability of attack actions and their impact on the target system, is very important [25]. A key feature of the application is the ability to modify this model to detect unusual network traffic behavior and develop protective measures. The combination of deterministic and stochastic methods allows not only to recreate the cyber-attack scenario, but also to assess the effectiveness of protective measures. However, given the dynamic nature of attacks on IoT devices, the proposed approach can be complemented with machine learning techniques, which will improve the accuracy of anomaly detection in data streams.
Anomalies in IoT device traffic are deviations from expected behavior that can indicate security risks or technical defects. It is important to identify such deviations quickly and accurately.
However, the above-mentioned methods lose their utility in large data sets due to their sensitivity to noise and outliers. To overcome these issues, an approach based on the z-index correction method is proposed, which provides high robustness and accuracy due to the use of median and median absolute deviation (MAD).
To detect anomalies, it is first necessary to analyze the data coming from IoT devices. Such information includes activity timestamps, connection parameters, error messages, network resource usage, and other characteristics that indicate the device’s performance.
Based on this information, a set of key characteristics is established, which makes it possible to estimate the real behavior of the device. This is necessary to establish a training network whose output reflects anomalous activity.
To assess the normality of each device, the range of acceptable values is calculated using the Corrected z-index method. The upper and lower limits separating normal values from abnormal values are defined: introduced: analysis.
= = + ℎ ℎ ∗
− ℎ ℎ ∗ where threshold is a parameter that determines the level of permissible deviation, MAD is the median absolute deviation, which is a stable measure of data dispersion.
To determine the deviation of a particular device, the normalized deviation function is ( ) −
Any values outside these limits are considered anomalies and moved to the next level of The anomaly detection process in IoT device traffic consists of a few basic steps, which allow sequential analysis of all device parameters, identification of deviations from the norm, and assessment of the critical level of the detected anomalies.
In the first step: anomalies in the values of each parameter for different devices are detected. The values obtained for this purpose are compared with the limits of normal behavior. If the value exceeds the specified threshold, it is flagged as a possible anomaly.
= | 0.675 ∗ ( −
| > ℎ ℎ ) (1) (2) (3) (4) (5) = | − | | | where boundary is the corresponding upper or lower limit of the normal range. Anomaly Duration is the period of time during which the parameter was outside the normal range.
Anomaly Duration is an indicator of how long the device was in an anomaly state: = −
In the third stage, we filter out insignificant anomalies. Accordingly, in order to reduce the number of false positives, filtering of insignificant anomalies is used. Each parameter has its own influence weight, which allows filtering out insignificant deviations that do not pose a threat. Filtering is carried out using the weight coefficient: the anomaly. limit: (6) (7) (8) (9) (10) (11) = , | on the most critical anomalies and avoid analyzing random parameter fluctuations. where is the significance factor for each parameter. This procedure allows you to focus Not all detected anomalies are critical for the system. To avoid false positives, a filtering mechanism for low-significant anomalies is used.
To adaptively determine the anomaly level, a weight factor is introduced for each device: where threshold is the set threshold coefficient that determines the permissible deviation (usually 3).
The aggregated average deviation for the entire data set can be expressed as: 1 =1 where is the total number of records in the sample.
In the second stage, after identifying potential anomalies, it is necessary to determine their main characteristics. To do this, each detected anomaly receives such attributes as the device identifier, the name of the parameter that has exceeded the normal limits, and the intensity of The intensity of the anomaly is defined as the ratio of the deviation of the parameter to its ∑ 2 =1 2
anomaly indicator is also calculated: =1 =1 where total time spent in the anomaly state, and Interval_(anomalu,i) is the total duration of observation.
For the practical implementation of the method, a software prototype in Python was developed. Each algorithmic component is presented as a separate module, which allows easy integration of the method into any IoT device monitoring system.
This approach provides high efficiency in detecting anomalies in real time, allowing for rapid response to possible risks and threats in IoT networks.
=
, + (1 − ) −1 С = − |
, | =1 =1 = | To reduce the impact of random fluctuations in the data, exponential smoothing is used: After determining the normal limits of device behavior, the process of anomaly detection is carried out. The input data for this stage are the calculated normal values of the features and their characteristics. The output data is a list of devices that demonstrate a significant deviation from normal behavior. The abnormal deviation is calculated as: Де – smoothed value, а α – smoothing coefficient (0 < α < 1).).
To detect long-term patterns of anomalous activity, a cumulative deviation indicator is
This technique allows for more accurate detection of long-term anomalies and minimizes the impact of single spikes, providing a more accurate analysis of network traffic of IoT devices.To evaluate the proposed method for detecting anomalies in device traffic, an activity log generation mechanism was developed. It is based on the use of distributions of input device attributes, such as timestamps, login attempts, network addresses, connection errors, etc. The generation took place with a random deviation of parameters within the normal range of values for each device. This allows us to test the robustness of our approach in real scenarios of IoT systems.
Based on the input data, frequency distributions of the main parameters of the devices were determined, and then artificial anomalies were created with a certain probability. To assess the effectiveness of the z-index-adjusted method, anomalous values were added to the base logs, after which the accuracy of their detection was analyzed. he generated logs underwent a correlation assessment stage between parameters to determine the degree of dependence between device attributes. Spearman's correlation coefficient was used for this, as it effectively captures non-linear relationships between variables. Additionally, independent anomalies were created in the form of random deviations in the data, allowing for a more comprehensive evaluation of the method’s robustness against false positives and its sensitivity to different types of deviations.
Generating a device activity log consists of several key steps. First, devices are selected from the total set according to the initial statistical distributions of their activity, ensuring that the dataset reflects real-world variability in network behavior. Then, activity timestamps for each device are defined and generated using a normally distributed time series, establishing a structured baseline for expected device activity. Random deviations are introduced according to the confidence interval parameter defined by the Modified Z-score, simulating fluctuations that naturally occur in network traffic.
A set of device attributes, such as login attempts, network connections, and error messages, is identified as these parameters often serve as key indicators of anomalous behavior. A correlation analysis is conducted to determine interdependencies between parameters, allowing structured patterns to be generated for further anomaly detection and classification. Additionally, control anomalies are introduced as values that fall outside the normal limits established using the Modified Z-score. This controlled injection of anomalies enables the assessment of the method’s effectiveness compared to traditional detection approaches, ensuring its reliability in real-world cybersecurity scenarios. This approach ensures a systematic and statistically sound method for evaluating anomaly detection algorithms, highlighting the strengths and weaknesses of the applied techniques while maintaining a realistic representation of device activity in IoT environments.
.
Figure 1. Scheme of processing and recording anomalies in the log.
The process of generating IoT device activity logs is performed taking into account the correlation characteristics of the data and modeling anomalous patterns. For this, the adjusted Z-index method is used, which allows you to effectively identify significant deviations in the behavior of devices. The generated log includes both normal data and controlled anomalies that are used to test the accuracy of detecting non-standard behavior.
In the process of generating an activity log, test anomalies are created for each device that correspond to different behavior parameters. Among them, several main categories can be distinguished.
An unusual number of device messages is formed by changing the data exchange rate. It can either increase, which may indicate a potential attack, or decrease, which may indicate technical failures or interference in the network.
An unusual number of authorization attempts determines possible security violations. An increased number of unsuccessful logins may indicate a hacking attempt or problems with authentication settings.
An unusual series of messages arriving in quick succession is an important indicator of anomalous behavior. If a device transmits many similar requests without interruption, this may be the result of a software failure or system overload.
Unusual time intervals between messages allow you to identify anomalies associated with changes in the device's interaction with the network. For example, unexpected delays or, conversely, too high a transmission rate can be signs of malfunctions.
An unusual number of connection errors is an indicator of malfunctions in the device or its interaction with the network. A high error rate can be associated with network instability, hardware problems, or attempts at unauthorized intervention.
The process of generating anomalies allows you to test the effectiveness of the method by determining its ability to detect different types of deviations in device behavior.
After generating the activity log, device profiles were formed, normal behavior limits were determined, and deviation analysis was performed. The total number of unique devices in the test log was 4804.
The quantitative assessment of the detected anomalies was carried out by comparing the found anomalies with the total number of injected deviations. The average level of anomaly detection accuracy was 79 percent.
The method best detected anomalies associated with changes in the time intervals between device messages. Detecting such deviations is effective because the time patterns are well modeled and have a clear structure that allows you to track changes.
The effectiveness of the proposed approach is confirmed by numerical calculations, which demonstrate higher accuracy and stability compared to classical statistical methods. The use of a modified Z-estimator allows reducing the impact of single outliers, ensuring resistance to sudden changes in traffic. Sensitivity of the method (Recall) = 89.96% indicates its ability to effectively detect real anomalies, while the accuracy (Precision) = 86.72% confirms a low proportion of false positives. Thanks to this, the method not only improves the quality of detection, but also adapts to different scenarios of IoT devices, reducing dependence on rigidly set threshold values. (16) =
∗ 100% + 242 (17) = ∗ 100% = 86.72
242 + 37
Where TP (True Positives) – true positive detections of anomalies, FP (False Positives) – false positives. The experimental results showed that the average accuracy value for all features is 86.72%, which indicates a low proportion of false positives and high reliability of identified anomalies. The sensitivity of our method is 89.96%, which means that the method effectively finds most of the real anomalies, minimizing their omission.
= + = 24224+227 ∗ 100%=89.96%
For a comprehensive assessment of the effectiveness of the anomaly detection method, the F1-score is used, which is the harmonic mean between accuracy (Precision) and sensitivity (Recall). This metric allows us to assess the balance between correct anomaly detection and minimizing false positives. A high F1-score indicates the stability of the algorithm and its ability to provide reliable identification of anomalous events without an excessive number of false positives.
The mathematical justification and calculation of the F1-score for our method are presented below.
∗ (20) 1 = 2 ∗
+ 86.72 ∗ 89.96 (21) 1 = 2 ∗ = 88.32%
86.72 + 89.96
To assess the effectiveness of the proposed method, an analysis of the main metrics characterizing its ability to detect anomalies in the traffic of IoT devices was conducted. The table shows quantitative indicators, which include the total number of anomalies in the generated log (AGJ), the number of actually detected anomalies (DA), as well as the distribution of true positive (TP), false negative (FN) and false positive (FP) cases. The key metric for assessing the accuracy of the algorithm is Precision, which determines the proportion of correctly detected anomalies among all detections. Additionally, the ratio of TP to (TP + FN) allows us to assess the sensitivity (Recall), which determines the ability of the algorithm to detect true anomalies without missing them. For complex analysis, the F1-score is used, which is the harmonic mean between precision and sensitivity, which gives a balanced assessment of the detection quality.
As can be seen from Table 1, the method demonstrates the highest accuracy for anomaly detection in the message interval (MI) category, confirming its effectiveness in detecting deviations in temporal patterns. The lowest accuracy is observed in the analysis of repeated messages (MR), indicating the potential need for additional model optimization for this type of anomaly. The overall accuracy of the algorithm is 84%, indicating its stability and efficiency compared to traditional statistical approaches.
The graph shows a comparison of anomaly detection methods based on the Precision, Recall, and F1-score metrics. Autoencoder shows the best results, indicating its ability to accurately and completely identify anomalies.
Modified Z-score and Rosner’s Test have similar performance, but are slightly inferior to Autoencoder.
Holt-Winters shows the worst metrics, indicating its less effective recognition of anomalous patterns in the data.
The graph illustrates the detection of anomalies in the outgoing traffic of the used IoT devices.
Normal traffic is indicated by a dotted line, and the red line shows anomalous traffic. Black crosses indicate isolated anomalous events that differ significantly from the average level of activity. Spikes and drops in intensity indicate possible attacks or atypical network behavior that requires detailed analysis.
The graph shows the distribution of IoT device traffic parameters. Yellow represents normal values, orange represents potential anomalies, and pink represents stable data.
It can be seen that parameter 2 (orange) has a wide spread, which may indicate the presence of anomalous values, while parameter 3 (pink) is more stable and concentrated. Such analysis allows you to better detect deviations in traffic and assess the likelihood of attacks.
The boxplot illustrates an outlier analysis of IoT device traffic parameters. It can be seen that parameter 2 has the largest spread and number of outliers, indicating potential anomalies. Parameter 1 also contains several outliers, while parameter 3 is the most stable.
Such an analysis allows us to assess the distribution of values and detect atypical behavior of network traffic.
The method performed worst in detecting anomalies associated with the number of repeated messages. This may be due to the fact that small changes in the frequency of messages fell within the range of normal values, which required a more precise adjustment of the boundaries of normal behavior.
This paper proposes an approach to detecting anomalies in the traffic of Internet of Things devices based on statistical methods. The method includes constructing numerical characteristics of device profiles, determining their normal values, and searching for deviations from the norm.
The modified Z-estimator, Rosner test, and Holt-Winters method were used for analysis, which allow detecting both single and multiple anomalies, as well as analyzing time series. These methods allow for effective detection of deviations without the need for training on labeled data, which is a key advantage in the IoT environment.
Numerical evaluation of the approach's effectiveness showed that the average anomaly detection accuracy for all features was 84%, with the best results (91%) obtained for the analysis of message intervals. The method provides high computational speed and can be used in environments with limited computing resources.
The advantages of the proposed approach include its adaptability to different types of devices, the ability to work with unlabeled data, and the minimal computing power requirements.
The main direction of further research is to expand the set of features and compare the effectiveness of different statistical methods for anomaly detection in IoT networks.
AI tools were used solely as translation and proofreading aids. All content was originally authored by the submitting party.