Hybrid Behavioral Intrusion Detection for Zigbee Smart Home Networks Using Metadata-Based Learning

Zigbee is widely used in smart home environments due to its low-power and mesh networking capacities. However, its lightweight protocol design and decentralized topology introduce significant security vulnerabilities, including spoofing and denial-of-service attacks. Traditional signature-based intrusion detection systems are unsuitable for Zigbee networks due to limited device resources and the lack of labeled attack datasets. This paper proposes a lightweight, metadata-based hybrid intrusion detection framework suitable for Zigbee smart home networks. The proposed system integrates behavioral clustering (PCA + DBSCAN) for device role inference, unsupervised anomaly detection using Isolation Forest for unknown threat identification, and supervised Random Forest (RF) classification. The framework is evaluated on four real-world Zigbee traffic datasets collected from SmartThings Hub generations 2 and 3 under different deployment configurations. Experimental results demonstrate strong detection performance, achieving a ROC-AUC of 0.98 in supervised evaluation while retaining the ability to spot anomalies that haven't been noticed before without labeled data. The proposed approach provides an interpretable, resourceefficient, and secure solution suitable for constrained smart home environments.