There may be provided a method for detecting a cyberattack, the method may include receiving, by a computerized system, a first data set receiving or generating, by the computerized system, a second data set that comprises one or more cluster centroids associated with one or more internet of things cyberattacks; and related to behavior of multiple internet of things devices; determining relationships between outliers that belong to the first data set and the one or more cluster centroids; and determining whether the first data set is indicative of the one or more cyberattacks based on the relationships.