  Internet-of-things (IoT) devices are vulnerable to malicious operations by
attackers, which can cause physical and economic harm to users; therefore, we
previously proposed a sequence-based method that modeled user behavior as
sequences of in-home events and a base home state to detect anomalous
operations. However, that method modeled users' home states based on the time
of day; hence, attackers could exploit the system to maximize attack
opportunities. Therefore, we then proposed an estimation-based detection method
that estimated the home state using not only the time of day but also the
observable values of home IoT sensors and devices. However, it ignored
short-term operational behaviors. Consequently, in the present work, we propose
a behavior-modeling method that combines home state estimation and event
sequences of IoT devices within the home to enable a detailed understanding of
long- and short-term user behavior. We compared the proposed model to our
previous methods using data collected from real homes. Compared with the
estimation-based method, the proposed method achieved a 15.4% higher detection
ratio with fewer than 10% misdetections. Compared with the sequence-based
method, the proposed method achieved a 46.0% higher detection ratio with fewer
than 10% misdetections.
