The operations of home IoT devices by attackers can cause serious problems.
However, such attacks are difficult to detect.
In this paper, we propose a method to detect such attacks based on user behavior.
We model user behavior as a sequence of events.
Our method learns sequences of events for each one of a predefined set of conditions and detects attacks by comparing the sequences of the events including the current operation with the learned sequences.
We evaluate our method by using data collected by monitoring the behavior of four users.
Based on the results of this evaluation, we demonstrate the accuracy of our method and discuss the limitations of our method.