AppSentry: Detecting Compromised IoT Devices Through Companion App Behavioral Divergence Analysis

IoT companion apps-the mobile applications that configure, control, and monitor IoT devices-encode implicit behavioral models of their paired devices through protocol parsers, response validators, and UI state machines. We observe that when an IoT device is compromised (via firmware modification, malware infection, or man-in-the-middle interception), its runtime behavior necessarily diverges from the behavioral model embedded in its companion app, producing detectable inconsistencies in message timing, response structure, state transitions, and side-channel characteristics. We present AppSentry, a system that automatically extracts behavioral specifications from IoT companion apps through hybrid static-dynamic analysis and continuously monitors app-device interactions to detect compromiseinduced divergences. AppSentry introduces three technical contributions: (1) a Protocol Behavior Graph (PBG) extraction technique that recovers the expected device behavioral model from companion app bytecode without requiring access to the device firmware; (2) a Multi-Channel Divergence Detector (MCDD) that monitors network traffic, BLE/Wi-Fi signaling, and physical side channels simultaneously to identify behavioral deviations across complementary observation channels; and (3) an Adaptive Threshold Engine (ATE) that learns device-and environmentspecific baselines to distinguish genuine compromise from benign variability. We evaluate AppSentry on 164 real IoT devices spanning 38 product categories from 27 manufacturers, including smart locks, cameras, medical devices, smart plugs, environmental sensors, and voice assistants. Across 11 compromise scenariosranging from firmware backdoors and protocol downgrade attacks to BLE relay and side-channel exfiltration-AppSentry achieves 95.7% detection rate at 2.1% false positive rate with a median detection latency of 8.2 seconds, requiring no modifications to either the app or the device.