Anomaly Behavior Analysis System for ZigBee in smart buildings

Smart Building (SB) exploits advances in information and communication technologies in order to provide the next generation of information and automation services that will significantly reduce operational costs and improve performance and efficiency. SB elements are typically interconnected using short range wireless communication technologies such as ZigBee, which is the most used wireless communication protocol for SBs. However, ZigBee protocol has multiple vulnerabilities that can be exploited by cyberattacks. In this paper, we present an Anomaly Behavior Analysis System (ABAS) for ZigBee protocol to be used in SBs. Our ABAS can detect both known and unknown ZigBee attacks with a high detection rate and low false alarms. Additionally, after detection, our system classifies the attack based on the impact, origin, and destination. We evaluate our approach by launching many attack scenarios such as DoS, Flooding, and Pulse DoS attacks, and then we compare our results with other intrusion detection systems such as secure HAN, signature IDS, and specification IDS.