Abstract Cyber Physical Systems (CPS) integrate physical processes with electronic computing devices and digital communication channels. Their proper operation might be affected by two main sources of abnormality, security attacks and failures. The topics of fault diagnosis and security attack analysis in CPS have been studied extensively in a stand-alone manner. However, considering the co-existence of both sources of abnormality, faults and attacks, in a system and being able to differentiate among them, is an important and timely problem not yet addressed adequately. In this work, we study the internal communication environment of an Energy Aware Smart Home (EASH) system. More specifically, we formally define the problem of differentiating between component failures and network attacks in EASH, based on their effect on the communication behaviour. We formally show the correlation between such abnormality sources and provide a machine learning based framework for the differentiation problem. Our framework is evaluated using a simulation as well as a real-time testbed environment, demonstrating a promising accuracy in classification of over 85%. Based on the obtained experimental results, we also provide a detailed analysis on the considered classes and features used in the proposed approach, which can further improve the classification accuracy.