Abstract: There may be provided a method for detecting a cyberattack or an operational issue, the method may include generating, by an IOT device or by an intermediate device located upstream to the IOT device and downstream to a computerized system, a first core-set, wherein the core-set comprises weighted records that are an approximation of a first data set related to a behavior of the IOT device; sending to the computerized system the first core-set; and finding, by the computerized system, outliers in the first core-set, and labeling the outliers as cyber attacks or operational events by the relations between the outliers and a second dataset of cluster centroid indicative of cyber attacks or operational events.

Abstract: There may be provided a method that includes receiving or generating a first plurality (N) points within a first multi-dimensional space that has M dimensions; M being a positive integer that is smaller than N; wherein the N points represent one or more behaviors of the one or more IOT devices; wherein a clustering of the N points within the first multi-dimensional space results in at least some clusters that are inseparable from each other; generating a representation of the N points within a second multi-dimensional space that has at least N dimensions; wherein a clustering of the N points within the second multi-dimensional space results in clusters that are separable from each other; calculating projections of the N points on a sub-space that has a second plurality (Q) of dimensions; wherein Q is a function of a relationship between a number (K) of clusters and an allowed error (?); computing a core-set that comprises a weighted subset of the projections; clustering the projections of the weighted subset

Abstract: There may be provided a method for detecting a cyberattack, the method may include receiving, by a computerized system, a first data set receiving or generating, by the computerized system, a second data set that comprises one or more cluster centroids associated with one or more internet of things cyberattacks; and related to behavior of multiple internet of things devices; determining relationships between outliers that belong to the first data set and the one or more cluster centroids; and determining whether the first data set is indicative of the one or more cyberattacks based on the relationships.