Over the last two decades, there has been growing realisation that the user is not the weakest link in cybersecurity. Involving the user in a human-in-the-loop fashion in the process of security can have benefits in several aspects, including in cyber intrusion detection. The human-as-a-security-sensor paradigm has shown that it is possible to involve the user as a valuable source of data for detection, and in fact with a predictable level of accuracy. However, this paradigm has currently only been applied in conventional computer systems, such as desktop computers. Our aim here is to extend it for Internet of Things (IoT) environments too, specifically in detecting command injection attacks against IoT devices, whereby a user can be informed automatically about a new IoT device activity that has been detected on the network and can reason as to whether this is legitimate or not. The activity detection is based on a time series forecasting approach, where the assumption is that an abrupt change in the trend of network traffic rate, is an indication of a new activity having been triggered. Our evaluation of two time series forecasting approaches for different training window sizes, as well as of activity detection based on the best-performing of the two approaches, has shown that this is a realistic method for notifying the user.