Method and apparatus for monitoring abnormal iot device

An apparatus for monitoring an abnormal behavior of a plurality of IoT devices comprising:

• a processor;
• a network interface;
• a memory;
• and
• a computer program loaded into the memory and executed by the processor,
• wherein the computer program comprises
• an instruction for determining abnormality of a behavior of each of the plurality of IoT devices based on traffic data representing the behavior of each of the plurality of IoT devices;
• an instruction for clustering the behavior of each of the plurality of IoT devices based on the traffic data and a result of the determining the abnormality;
• and
• an instruction for generating data for representing a plurality of clusters formed as a result of the clustering such that a first cluster corresponding to a normal behavior cluster and a second cluster corresponding to an abnormal behavior cluster are displayed on different planes, the first cluster and the second cluster being divided based on the result of the determining the abnormality.

A computer-readable recording medium recording a computer program including computer program instructions executable by a processor for monitoring an abnormal behavior of a plurality of IoT devices,

• wherein the computer program instructions are executed by a processor of a computing device for performing operations comprising
• determining abnormality of a behavior of each of the plurality of IoT devices based on traffic data representing the behavior of each of the plurality of IoT devices;
• clustering the behavior of each of the plurality of IoT devices based on the traffic data and a result of the determining the abnormality;
• and
• generating data for representing a plurality of clusters formed as a result of the clustering such that a first cluster corresponding to a normal behavior cluster and a second cluster corresponding to an abnormal behavior cluster are displayed on different planes, the first cluster and the second cluster being divided based on the result of the determining the abnormality.