HomeGuardian: Detecting Behavioral Anomalies Through Implicit Profiling in Smart Home Systems

Smart homes, enabled by the Internet of Things (IoT), offer substantial convenience but also introduce security challenges. These often stem from anomalous behaviors, including improper user interactions and malicious attacks. Although various behavior-modeling methods have been proposed, userdevice interactions are often unobservable in practice due to encrypted traffic and limited vendor access, while anomaly detection models suffer severe degradation during cold start. These issues greatly limit real-world deployability. Moreover, existing approaches struggle to capture infrequent behaviors, leverage temporal context, and handle noisy user activities, resulting in suboptimal detection performance. To address these challenges, we propose HomeGuardian, a non-intrusive end-to-end anomaly detection system based on mirrored gateway traffic. It first employs aRobustContrastiveBehaviorIdentification (RCBI) algorithm to infer user-device interactions from encrypted traffic and obtain behavior data. Building on this, we develop an anomaly detection framework with three components: Loss-guided Dynamic Mask Strategy (LDMS), Three-level Time-aware Position Embedding (TTPE), and Noise-aware Weighted Reconstruction Loss (NWRL). LDMS enhances learning of infrequent behaviors, TTPE incorporates temporal context, and NWRL reduces behavioral noise through adaptive reconstruction weighting. To improve cold-start performance, we further introduce the Dynamic Risk Compensation Algorithm (DRCA), which maintains stable detection capability with limited historical data. Extensive experiments show that HomeGuardian consistently outperforms state-of-the-art baselines while providing accurate and interpretable results.