Methods and apparatus to identify abnormal behavior within a set of internet-of-things devices

Abstract

Methods and apparatus automatically identify which Internet-of-Things (IoT) devices within a set are behaving in a manner non-compliant with a target behavior. Each IoT device is assigned to a grid point in a notional m-dimensional space. A respective assessment module is arranged to monitor behavior of a group of IoT devices assigned to grid points aligned with one another at a respective position along the respective dimension, and to produce an output indicative of non-compliant behavior if the monitoring indicates that behavior in the group of IoT devices deviates from a behavioral model of the IoT devices of said group. An identification module identifies at least one non-compliant IoT device in the set of IoT devices by combining outputs from the assessment modules assigned to the different dimensions of the space. The assessment modules may use trained machine-learning algorithms embodying a model of normal behavior of the group of devices.