# IoTBystander: A Non-Intrusive Dual-Channel-Based Smart Home Security Monitoring Framework
## 2 Related Work
### Side-Channel-Based Monitoring  
Side-channel-based monitoring does not require modifications or cooperation from IoT stakeholders, making it a promising approach to mitigate the time-to-market challenges associated with deploying security solutions. Through a literature survey, we identified four categories of side channels that hold significant potential for smart home monitoring: encrypted network traffic, audio, vision, and system load. In addition, we surveyed existing hybrid approaches that aggregate multi-source or multi-modal data for monitoring. Traffic-Based Monitoring. Traffic anomaly detection is a significant research direction as it encompasses monitoring, collection, evaluation, and interpretation of data transmitted through network communications. Its development is broadly categorized into two stages: rule-based methods [26; 27] and machine- or deep-learning-based techniques [28]. For example, Snort initially extracted association rules for different types of anomalies and then conducted pattern matching between incoming traffic and this ruleset to identify anomalous behaviors [26]. Although rule-based traffic analysis methods provide simplicity and interpretability, they face limitations when encountering unknown or dynamically evolving traffic patterns. Consequently, network traffic analysis methods that utilize machine learning techniques have gained considerable attention and are widely applied in tasks such as traffic classification and anomaly detection, employing approaches such as decision trees, support vector machines (SVMs), and random forests [29]. Moreover, traffic analysis methods that leverage deep learning approaches, such as CNNs and RNNs, have demonstrated substantial improvements in the accuracy of traffic classification and anomaly detection in the context of large-scale and high-dimensional network traffic [30]. For example, [PERSON] et al. proposed a CNN-based framework for anomaly detection, which also demonstrated that both a CNN and its variant architectures exhibit superior detection performance compared to classical machine learning classifiers on the KDD Cup dataset [31]. [PERSON] et al. proposed a network traffic anomaly detection approach that integrates the spatial feature extraction capabilities of CNNs with the temporal sequence modeling strengths of LSTM, thus achieving improved detection performance compared to the previously discussed methods [32]. [PERSON] et al. exploited side channel information leaks to infer sensitive and detailed user information by analyzing the network traffic of web applications secured by HTTPS and WPA/WPA2 Wi-Fi [33]. Audio-Based Monitoring. In light of the demonstrated effectiveness of CNN-based models in image classification, [PERSON] et al. conducted an exploration of their applicability in audio recognition. This investigation involved the evaluation of five architectures: deep neural networks (DNNs), AlexNet [34], VGG [35], Inception [36], and ResNet [37] on benchmark audio datasets, demonstrating promising results [38]. Subsequently, this research has promoted the widespread adoption of CNN architectures for event recognition utilizing audio channel information [39; 40; 41]. For instance, [PERSON] et al. proposed the RCNN model, which integrates a CNN to extract high-level features from local spectral information with an RNN to capture long-term temporal dynamics in audio [41]. [PERSON] et al. introduced