# IoTBystander: A Non-Intrusive Dual-Channel-Based Smart Home Security Monitoring Framework
## 2 Related Work
### Side-Channel-Based Monitoring
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Methodology** & **Data Type** & **Application** &
\begin{tabular}{c} **Multi-Platform** \\ **System** \\ **Considered?** \\ \end{tabular} \\ \hline
[7] & Rule Hypothesis Generation & IoT Events & Anomaly Detection & No \\ \hline
[11] & DFA Modeling & IoT Traffic & Malicious App Detection & No \\ \hline
[20] & Model Checking & Source Code & Security Analysis & No \\ \hline
[21] & Dynamic Policy Enforcement & Source Code & Security Enforcement & No \\ \hline
[22] & Satisfiability Modulo Theories & Source Code & Inter-App Interaction Detection & No \\ \hline
[23] & Classification & IoT Event & Sensor Failure Detection & No \\ \hline
[24] & State Transition Analysis & IoT Event & Faulty Device Detection & No \\ \hline
[25] & Causal Association Rules & IoT Event & Anomaly Detection & No \\ \hline Ours & Machine Learning+Rule Matching & Audio+Traffic & Event Monitoring & Yes \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of security monitoring in IoT. Ubicoustics, a plug-and-play model developed for environmental activity recognition, which is built based on the pre-trained Vggish model [42]. Vision-Based Monitoring. [PERSON] et al. employed a combination of techniques, including background subtraction algorithms (to delineate subject outlines), Kalman filters (to mitigate noise and address data imprecision), and optical flow (to track stationary subjects within the scene), to process video data. The processed data are then input into a K-Nearest Neighbor (KNN) classification algorithm to identify the fall states of elderly people [43]. [PERSON] et al. proposed to utilize PrimeSense 3D sensors to extract features of skeletal joints for training a hidden Markov model that aims to recognize the daily activities of elderly individuals in indoor environments [44]. [PERSON] et al. proposed IoTSentry, which employs a Siamese deep neural network to extract high-level semantic features from streaming video data [45]. This approach facilitates the detection of variations in the appearance of IoT devices upon the occurrence of events, establishing a benchmark for verifying IoT events through a video channel. Load-Based Monitoring. [PERSON] et al. proposed _ElectriSense_, which identifies and classifies electrical events associated with the operation of electronic devices utilizing switch-mode power supplies (SMPSs). This model leverages the electromagnetic interference (EMI) generated during SMPS operation, which exhibits a highly repeatable frequency domain signature, to effectively differentiate between various device types [46]. [PERSON] et al. introduced a non-intrusive monitoring method to assess the power status of loads through sweep frequency response analysis (SFRA) utilizing support vector machines (SVMs) [47]. [PERSON] et al. improved the accuracy of device identification in non-intrusive load monitoring by combining artificial neural networks with particle swarm optimization techniques [48]. Multi-Channel Approaches. Recent studies have proposed various techniques for fusing different data sources or modalities to enhance performance in anomaly detection and other security tasks in smart homes. For example, [PERSON] et al. introduced a human activity recognition framework that integrates multiple environmental sensor data, showcasing its applicability to context-aware monitoring in smart environments [49]. By combining data from multiple types of sensors (such as motion detectors, temperature sensors, and cameras), their approach improves the accuracy of recognizing human activities, which can be critical for applications such as intrusion detection, fall detection, and energy management. Similarly, [PERSON] et al. proposed a two-level fusion framework for cyber-physical anomaly detection where they fused sensor data with network traffic information to enhance the detection of anomalies in cyber-physical systems [50].