Abstract: There may be provided a method for detecting a cyberattack or an operational issue, the method may include generating, by an IOT device or by an intermediate device located upstream to the IOT device and downstream to a computerized system, a first core-set, wherein the core-set comprises weighted records that are an approximation of a first data set related to a behavior of the IOT device; sending to the computerized system the first core-set; and finding, by the computerized system, outliers in the first core-set, and labeling the outliers as cyber attacks or operational events by the relations between the outliers and a second dataset of cluster centroid indicative of cyber attacks or operational events.

Abstract: There may be provided a method for detecting a cyberattack, the method may include receiving, by a computerized system, a first data set receiving or generating, by the computerized system, a second data set that comprises one or more cluster centroids associated with one or more internet of things cyberattacks; and related to behavior of multiple internet of things devices; determining relationships between outliers that belong to the first data set and the one or more cluster centroids; and determining whether the first data set is indicative of the one or more cyberattacks based on the relationships.