# IoTBystander: A Non-Intrusive Dual-Channel-Based Smart Home Security Monitoring Framework
## 1 Introduction
Specifically, we introduce IoTBystander, a non-intrusive dual-channel security monitoring framework designed for standalone deployment. This design ensures that IoTBystander can be deployed across diverse smart home environments without the need for vendor cooperation or system modifications, making it a versatile and universally applicable solution. IoTBystander integrates effective event recognition methods from both audio and network traffic channels. Additionally, it features a novel dual-channel aggregation mechanism that cross-verifies event integrity and combines insights from both channels to improve monitoring performance. Unlike existing monitoring systems that rely solely on event messages from smart IoT devices, IoTBystander can also monitor the activities of dumb devices, thus expanding the scope of monitoring. This broader coverage provides a richer context for subsequent analyses, including configuration debugging, anomaly detection, and failure diagnosis. To evaluate IoTBystander, we established a real-world testbed comprising nine smart devices and eleven dumb devices, conducting a series of comprehensive experiments. IoTBystander achieved an overall accuracy of 92.86% for recognizing events of smart devices, 95.09% for events of dumb devices, and 94.27% for all devices, demonstrating its effectiveness. A statistical reliability analysis confirms that IoTBystander produces consistent and reliable results across different scenarios. Additionally, computational efficiency tests show that IoTB bystander performs well on both PCs and resource-constrained platforms like the Raspberry Pi. Furthermore, a case study involving five different scenarios illustrates the advantages of IoTB bystander, highlighting its enhanced performance in real-world settings. The contributions of this work are summarized as follows:  
* We identify three key limitations in the existing smart home security monitoring approaches. To address these, we propose IoTB bystander, a more realistic and robust monitoring framework that utilizes two ubiquitous physical channels for smart home monitoring. Specifically, IoTB bystander (1) ensures accurate activity detection even in the presence of failures, misoperations, or attacks; (2) monitors both smart and non-smart devices; and (3) operates without requiring modifications to IoT devices or platforms. * We present effective methods for dual-channel monitoring, taking into account the scarcity and heterogeneity of data in specific deployments. We extend the existing audio-based and traffic-based event recognition techniques, proposing an efficient pipeline to jointly monitor smart home activities. Additionally, we introduce a novel dual-channel aggregation mechanism that cross-verifies the integrity of IoT events and integrates insights from both audio and network traffic. This approach offers a more robust and universally applicable solution for IoT security monitoring, overcoming the limitations of traditional event-based systems. * A real-world testbed is built to evaluate IoTB bystander. The results show that IoTB bystander achieves an overall accuracy of 94.27% when monitoring a combination of smart and dumb devices. A statistical reliability analysis confirms consistent performance, while computational efficiency tests demonstrate effective operation on both PCs and resource-constrained platforms such as the Raspberry Pi. A case study with five scenarios further highlights the advantages of IoTB bystander, showcasing its superior performance in real-world environments. The remainder of this paper is organized as follows. The related works are discussed in Section 2. We introduce the background of smart homes in Section 3. Then, we present the design overview of IoTB bystander in Section 4. Sections 5 and 6 provide the technical details of three key modules of IoTB bystander. After that, Section 7 evaluates the performance. The limitations and ethical considerations are discussed in Section 8. Finally, Section 9 concludes the paper.