  In an Internet of Things (IoT) environment (e.g., smart home), several IoT
devices may be available that are interconnected with each other. In such
interconnected environments, a faulty or compromised IoT device could impact
the operation of other IoT devices. In other words, anomalous behavior
exhibited by an IoT device could propagate to other devices in an IoT
environment. In this paper, we argue that mitigating the propagation of the
anomalous behavior exhibited by a device to other devices is equally important
to detecting this behavior in the first place. In line with this observation,
we present a framework, called IoT Anomaly Detector (IoT-AD), that can not only
detect the anomalous behavior of IoT devices, but also limit and recover from
anomalous behavior that might have affected other devices. We implemented a
prototype of IoT-AD, which we evaluated based on open-source IoT device
datasets as well as through real-world deployment on a small-scale IoT testbed
we have built. We have further evaluated IoT-AD in comparison to prior relevant
approaches. Our evaluation results show that IoT-AD can identify anomalous
behavior of IoT devices in less than 2.12 milliseconds and with up to 98% of
accuracy.
