A system for Internet of Things, loT, security, comprising at least one IoT device and an IoT hub, wherein: each IoT device of the at least one IoT device comprises means for: receiving and collecting environmental data from the environment and collecting internal security state data of the IoT device, wherein the data is aggregated IoT data including at least two different types of data; making a determination as to whether or not to send each of the at least two different types of data to the IoT hub, wherein the determination to send for each of the at least two types data is made based on whether the each of the at least two types of data is outside of a predetermined range; when the determination is positive, communicating the at least two different types of IoT data to the IoT hub; and the IoT hub comprises means for: storing a set of security rules that are associated with an expected condition of the at least one IoT device, wherein the set of security rules stored in IoT hub is based on a model of the normal behavior of the at least one IoT device representing the state of the at least one IoT device while working under normal conditions and the set of rules is defined such that the set of rules is violated if an attack or other security intrusion or security threat occurs, wherein the set of security rules are based on multiple types of data considered together such that the fact that one type of data is outside of the predetermined range does not in and of itself result in a violation of the security rules; receiving the IoT data associated with the at least one IoT device; making a determination, based on the IoT data and on the set of security rules, as to whether the set of security rules has been violated; and selectively sending an alert based on the determination. receiving and collecting environmental data from the environment and collecting internal security state data of the IoT device, wherein the data is aggregated IoT data including at least two different types of data; making a determination as to whether or not to send each of the at least two different types of data to the IoT hub, wherein the determination to send for each of the at least two types data is made based on whether the each of the at least two types of data is outside of a predetermined range; when the determination is positive, communicating the at least two different types of IoT data to the IoT hub; and the IoT hub comprises means for: storing a set of security rules that are associated with an expected condition of the at least one IoT device, wherein the set of security rules stored in IoT hub is based on a model of the normal behavior of the at least one IoT device representing the state of the at least one IoT device while working under normal conditions and the set of rules is defined such that the set of rules is violated if an attack or other security intrusion or security threat occurs, wherein the set of security rules are based on multiple types of data considered together such that the fact that one type of data is outside of the predetermined range does not in and of itself result in a violation of the security rules; receiving the IoT data associated with the at least one IoT device; making a determination, based on the IoT data and on the set of security rules, as to whether the set of security rules has been violated; and selectively sending an alert based on the determination. storing a set of security rules that are associated with an expected condition of the at least one IoT device, wherein the set of security rules stored in IoT hub is based on a model of the normal behavior of the at least one IoT device representing the state of the at least one IoT device while working under normal conditions and the set of rules is defined such that the set of rules is violated if an attack or other security intrusion or security threat occurs, wherein the set of security rules are based on multiple types of data considered together such that the fact that one type of data is outside of the predetermined range does not in and of itself result in a violation of the security rules; receiving the IoT data associated with the at least one IoT device; making a determination, based on the IoT data and on the set of security rules, as to whether the set of security rules has been violated; and selectively sending an alert based on the determination.