Abstract

Building Management Systems (BMS) are essential for modern smart buildings, managing services such as HVAC, lighting, and access control. However, their reliance on open communication protocols like BACnet makes them vulnerable to faults and cyberattacks. Detecting anomalies in BMS traffic is therefore important for maintaining both security and reliability.

This thesis investigates the use of machine learning, specifically the Isolation Forest algorithm, for anomaly detection in BMS network traffic. Five weeks of real traffic data were collected from a live BMS using a Raspberry Pi configured as a passive sniffer. The captured pcap files were converted into CSV format, with features such as IP addresses, protocols, and packet lengths extracted for analysis. Isolation Forest was then trained and tested under four time-window configurations (1h, 6h, 24h, 7d) to evaluate how temporal granularity influences detection outcomes.

The results show that the algorithm successfully modeled the stable and repetitive baseline of BMS communication. Shorter windows identified more fluctuations, demonstrating higher sensitivity, while longer windows produced highly stable baselines but flagged few or no anomalies. No anomalies were strongly associated with specific protocols, and the overall traffic composition remained consistent across the dataset.

The findings highlight that even in the absence of labeled data, unsupervised learning can provide valuable insights into BMS traffic. While anomalies were limited in this case, the study demonstrates the potential of Isolation Forest as a lightweight baseline tool for anomaly detection, and it underlines the trade-off between sensitivity and stability in configuring such systems.