There’s a lot of good process mining work being done with Internet of Things (IoT) devices, often about discovering and understanding the vast streams of low level data these devices can provide. The proliferation of Internet-connected gadgets - 40 billion by 2034, by one prediction - creates a vast attack surface for various amateur and professional malcontents. The personal version of this threat is deranged strangers threatening your baby through your internet-connected baby monitor. The institutional version is organised crime and malicious state actors using thousands of hacked IoT devices to do a distributed denial of service attack on your local power station.

You can use process mining and machine techniques to detect these attacks, at least in the lab. We introduce a pipeline for doing so in our latest paper, from myself, Mashal Ashraf, Marimbay Kadirov, and Andrzej Janusz. The pipeline discovers a protocol-level process model from a subset of a public dataset called IoT-23, giving a sequence description independent of specific ports and hosts. It then calculates process conformance metrics, and these are added as features when training a machine learning model for intrusion detection. This model outperforms benchmark techniques, and the process conformance features are the most important for the model’s threat identification.

We recently presented the paper, IoT Threat Detection Using Process Conformance and ML Classification, at ASPAI 2026, where it picked up the Best Paper award. There is a pre-print and slides.

References

Burke, A.T, Ashraf, M, Kadirov, M. and Janusz, A. (2026). IoT Threat Detection Using Process Conformance and ML Classification. Asia-Pacific Symposium on Process and Artificial Intelligence (ASPAI 2026).

Zscaler, Mobile, IoT and OT Threat Report 2025. report

Garcia, Parmisano, and Erquiaga, IoT-23: A labeled dataset with malicious and benign IoT network traffic, 2020. doi:10.5281/zenodo.4743746.