# IoTBystander: A Non-Intrusive Dual-Channel-Based Smart Home Security Monitoring Framework
## 2 Related Work  
### Security Monitoring in IoT  
The increasing complexity and interconnectivity of Internet of Things (IoT) devices in smart homes have significantly broadened the scope of security challenges. Security monitoring, which involves the continuous observation and collection of system data, has become a critical focus in the field of IoT security. The goal of security monitoring is to produce reliable, comprehensive, and real-time data that can serve as input for subsequent decision-making tasks, such as anomaly detection, failure diagnosis, or intrusion detection. Several studies have explored different monitoring approaches that focus on capturing device activities, environmental changes, or communication patterns within smart homes. These approaches lay the foundation for building robust security systems that can later interpret the data for decision-making tasks. For example, [PERSON] et al. made notable contributions to IoT security monitoring by analyzing traffic patterns, application security, device behaviors, and privacy aspects within smart home ecosystems [6; 11; 16; 17]. Similarly, [PERSON] et al. identified vulnerabilities in IoT protocols, revealing security risks such as critical flaws in state transitions and weaknesses in protocols like MQTT [18; 19]. These studies emphasize the importance of continuous and accurate monitoring to ensure that security systems can later perform decision-making tasks effectively. Rule-based monitoring approaches focus on verifying the compliance of smart home operations against predefined security rules using deterministic models or formal verification techniques. These methods rely on systematic observation of events and activities to check whether they align with expected behaviors. [PERSON] et al. introduced Soteria [20] and IoTGuard [21], which apply static and dynamic model checking techniques to verify smart home operations, ensuring that all activities adhere to predefined security properties. [PERSON] et al. modeled automation applications as Deterministic Finite Automators (DFAs), comparing event sequences derived from IoT traffic to detect rule violations [11]. Similarly, [PERSON] et al. proposed HomeGuard, a system that uses Satisfiability Modulo Theories (SMTs) to identify conflicts in automation rules during monitoring [22]. These rule-based systems focus on monitoring the flow of events and ensuring compliance with security standards, making them suitable for providing data input for higher-level decision-making approaches. Learning-based monitoring approaches aim to monitor system behavior by learning from historical data. These approaches involve the use of probabilistic models or machine learning techniques to capture patterns in device activity, network traffic, or sensor readings. For instance, [PERSON] et al. developed the SMART system, which monitors user activities by training classifiers on sensor data to detect deviations from expected behavior [23]. [PERSON] et al. proposed DICE, a framework for analyzing state transitions and contextual information to monitor system behavior [24]. Other research, such as the work by [PERSON] et al. [25], uses learning techniques to monitor causal relationships between system events. These learning-based monitoring approaches rely on training models to recognize and track patterns in real time, which can then serve as input for decision-making tasks such as identifying vulnerabilities or triggering responses to potential threats. Table 1 provides a summary of the aforementioned approaches. Despite the effectiveness of these approaches, they face common challenges. A key limitation of both rule-based and learning-based monitoring systems is their reliance on accurate event data. These systems are vulnerable to event-targeted attacks, such as data tampering, message interception, or event reordering, which can compromise the integrity of the monitoring data [14; 18; 19].