Category identifying anomalous iot device behavior