Detecting behavioral change of IoT devices using novelty detection based behavior traffic modeling

A non-transitory, computer-readable medium having program code stored thereon, the program code comprising instructions to:

• determine similarity measurements for variables across time intervals for each of a set of one or more device identifiers indicated in network traffic of the time intervals, wherein the variables are variables previously identified as correlating to device behavior and device identity;
• for each set of similarity measurements determined for each device identifier, generate a feature vector with the set of similarity measurements;
• input the feature vector into a local outlier factor with novelty detection model that was trained based on network traffic constrained to devices with stable behavior;
• and
• indicate detection of an anomaly if the local outlier factor with novelty detection indicates an outlier.

An apparatus comprising:

• a processor;
• and
• a machine-readable medium having program code stored thereon, the program code executable by the processor to cause the apparatus to,
• determine similarity measurements for variables across time intervals for each of a set of one or more device identifiers indicated in network traffic of the time intervals, wherein the variables are variables previously identified as correlating to device behavior and device identity;
• for each set of similarity measurements determined for each device identifier, generate a feature vector with the set of similarity measurements;
• input the feature vector into a local outlier factor with novelty detection model that was trained based on network traffic constrained to devices with stable behavior;
• and
• indicate detection of an anomaly if the local outlier factor with novelty detection indicates an outlier.