Detecting Rule Anomalies and Interference for Home Automation

Home Internet-of-Things (H-IoT) automation is increasingly threatened by single-rule anomalies (SRA) and cross-rule interference (CRI). These threats can produce outcomes diverging from or even contradicting user expectations, compromising H-IoT system security and potentially endangering user safety and property. Existing detection techniques for these threats are fundamentally limited as they overlook undocumented command side effects, creating a critical blind spot in security analysis. This paper introduces Cet-Miner, a method that obtains and models these side effects through black-box command testing. Cet-Miner models system behavior as a Bayesian-smoothed Markov Decision Process (MDP) to characterize the non-deterministic side effects. For side effects that are not immediately observable, it uncovers them by comparing semantic inferences with test results, and represents them via a latent state structure introduced into the MDP. Building on this method, we propose HA-Inspector, an end-to-end threat detection system that implements both a runtime SRA monitor and a CRI model checker. We evaluate our method and system on a real-world H-IoT testbed comprising 38 devices from 9 vendors. Results show Cet-Miner discovers 5 distinct types of side effects, and HA-Inspector outperforms state-of-the-art tools in detecting both SRA and CRI threats.