# IoTBystander: A Non-Intrusive Dual-Channel-Based Smart Home Security Monitoring Framework
## 1 Introduction  
With the continuous progress in Internet of Things (IoT) technologies and the growing consumer demand for higher living standards, the smart home sector is experiencing substantial growth. According to Grand View, the market is projected to expand at a compound annual growth rate (CAGR) of 27.07% between 2023 and 2030, with an estimated market value of USD 537.01 billion by 2030 [1]. The penetration of smart homes in households is expected to increase from 18.9% in 2024 to 33.2% in 2028 [2]. Smart homes are residences equipped with smart IoT devices that are interconnected through platforms designed to enhance comfort, convenience, energy efficiency, and more by integrating internet connectivity, automation, and remote control capabilities. Homeowners of smart homes can remotely monitor and control their devices through mobile applications and voice assistants, or configure automation rules to allow devices to function automatically based on predefined conditions (i.e., home automation). However, despite the many advantages, intricate interconnection, and interactions among IoT devices, platforms andapplications also broaden the attack surface, making the smart home more susceptible to a variety of security and safety vulnerabilities [3; 4; 5; 6; 7]. Traditional security monitoring solutions [4; 5; 7; 8; 9; 10; 11] typically rely on event sequences generated by IoT devices, such as device status changes or sensor readings, to detect anomalies. These systems often analyze predefined event patterns to identify deviations that may indicate security threats, such as unauthorized access, device malfunctions, or cyberattacks. While effective in controlled environments, these approaches suffer from several critical limitations. One major drawback is their susceptibility to attacks that tamper with event data, such as message forging, interception, or delay, which can compromise the reliability of the system [12; 13; 14]. Furthermore, many traditional methods are inherently dependent on the correct reporting of events by the devices themselves. As a result, the integrity of security monitoring is directly tied to the accuracy of device-generated data, leaving the system vulnerable to failures, misconfigurations, and attacks that manipulate event notifications. Additionally, these conventional solutions often struggle to account for non-smart devices (commonly referred to as \"dumb devices\") within the smart home ecosystem. Since these devices do not generate event notifications in the same manner as IoT devices, they are largely ignored by traditional security mechanisms. This oversight limits the monitoring scope, leaving potential vulnerabilities undetected. Moreover, the growing trend of fragmented smart home ecosystems, where devices from multiple manufacturers are integrated into a variety of platforms, creates further challenges. Each platform typically supports only a subset of devices, and, without universal standards, it becomes increasingly difficult to achieve comprehensive security monitoring [15]. In many cases, such systems require vendor cooperation or even modifications to the devices or platforms, which is often unfeasible or impractical, especially in real-world scenarios. As a result, these existing solutions face significant scalability and interoperability challenges, further complicating their deployment and reducing their overall effectiveness in heterogeneous multi-platform environments. To address the challenges posed by fragmented smart home ecosystems, we propose a platform-agnostic approach to achieve non-intrusive monitoring of physical activities. In this paper, we leverage two ubiquitous in situ physical channels, audio and network traffic, to monitor activities within smart homes. Each channel offers distinct advantages and limitations (see Section 7.2 for further details). To provide a more comprehensive and reliable view, we adopt a multi-modal perception strategy.