Physical Tells Digital Threats: Supervised ML-IDS for Multimodal IoT Telemetry in Smart Buildings
Year: 2025
Type: conference-paper
Abstract: Traditional machine learning-based intrusion detection systems (ML-IDS) in smart building environments face critical limitations, including heavy reliance on network traffic analysis, high computational overhead, and inability to detect insider threats. The solution lies in recognizing that cyber attacks in smart buildings inevitably manifest as anomalies in physical device behaviors, such as temperature fluctuations, unexpected door activations, and abnormal HVAC operations, which traditional network-based IDS systems completely overlook. This paper presents a novel supervised ML-IDS that leverages multimodal IoT telemetry data, combining physical sensor readings with device operational states to detect cyber attacks. Using a dataset with 221,859 telemetry records from smart building infrastructure, we demonstrate that physical sensor data (temperature, motion, door states) combined with Modbus protocol communications provide superior attack detection capabilities. Our multimodal telemetry-based ML-IDS achieves 84.47 % accuracy and 90.76 % AUC for binary attack detection, significantly outperforming conventional IoT security approaches while operating with minimal computational requirements suitable for edge deployment. The system successfully detects seven distinct types of attack: backdoor, DDoS, injection, password, ransomware, scanning, and XSS attacks. selective classification detectors demonstrate exceptional performance for specific attacks, such as scanning (85.66 % AUC) and DDoS ($\mathbf{8 4. 0 1 \%}$AUC). Our findings suggest that multimodal IoT telemetry data, particularly combined physical readings and device status indicators, provide sufficient discriminative features for effective cyber attack detection, including zero-day exploits and insider threats that manifest as anomalies in physical device behaviors.
Institutions: Cardiff University, Politeknik Siber dan Sandi Negara
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7130559311