VarLogger: Lightweight Runtime Anomaly Detection in IoT Sensor Nodes

The Internet of Things (IoT) enables large-scale distributed sensing, improving automation and real-time decision-making across domains such as smart cities and environmental monitoring. However, as IoT deployments increase in scale and complexity, ensuring the reliability of sensor nodes becomes increasingly challenging. A key issue is the timely and resource-efficient detection of faulty behavior in IoT nodes. Most existing solutions focus on a limited set of fault types, such as communication failures or sensor data anomalies, leaving many faults undetected. In this article, we propose VarLogger, a lightweight runtime anomaly detection method. Our key observation is that many IoT faults manifest as sub-normal software behavior, such as delayed function responses or repeated hardware access. VarLogger therefore monitors device-internal software event traces and their temporal and spatial properties. We design and evaluate two unsupervised learning-based methods to capture normal event traces and detect sub-normal behavior directly on the edge. Evaluation using real-world use cases and diverse fault types (software, communication, and others) demonstrates that the time-based method outperforms state-of-the-art approaches. VarLogger achieves an F1 score above 0.9, while memory and CPU analyses confirm its suitability for resource-constrained devices. Most importantly, VarLogger can detect previously unknown faults in a real-time and resource-efficient manner.