Device Fingerprinting Research Articles

Toward IoT device fingerprinting from proprietary protocol traffic via key-blocks aware approach

IoT Device fingerprinting of network traffic is valuable for many management and security solutions as it provides insights into the devices active on a network. Unfortunately, existing techniques focus on the public (de facto) standard protocol and suffer from low efficiency and high data packet dependence at flow-level granularity. Hence, accurately identifying the types of proprietary-protocol-oriented IoT devices is still a challenge that cannot be ignored. As a solution, we propose DeepFinger, a full-automated, byte-level payload fingerprint generation approach to fill this gap. DeepFinger aims to eliminate the manual intervention required to extract available payload-driven fingerprints, in the absence of priori protocol specification information. The key sight of DeepFinger is that it utilizes deep clustering to automatically cluster similar payloads and infer key-blocks as fingerprints. Through extensive evaluation, we demonstrate that DeepFinger achieves the average TPR with 98.81%, the average FTF with 98.74%, and the average FPR with 0.07% on the dataset containing multiple proprietary protocols. In addition, on three datasets containing public protocols such as MQTT, Modbus, HTTP, and XMPP, DeepFinger also achieved excellent performance by virtue of its extensibility. These results suggest that DeepFinger can be a promising tool for automatizing the payload fingerprint extraction process, based on proprietary protocol assumption.

The Development of a Data Collection and Browser Fingerprinting System

The urgent need to protect user privacy and security has emerged as the World Wide Web has become an increasingly necessary part of daily life. Browser fingerprinting is a very interesting topic in the industry of technology security. New technology will always raise new security issues and browser fingerprinting will undoubtedly follow the same process. It has become one of the most popular topics in online privacy because, to date, there is still no exact solution as to how to stop it entirely. The majority of solutions just aim to reduce the likelihood of obtaining a browser fingerprint. Research on browser fingerprinting is unquestionably required since it is essential to educate users, developers, policymakers, and law enforcement about it so that they can make strategic choices based on knowledge. Browser fingerprinting must be recognised in order to defend against privacy problems. A browser fingerprint is described as data gathered by the receiving server to identify a distant device, and it is different from cookies. Websites frequently utilize browser fingerprinting to obtain information about the type and version of the browser, as well as the operating system, and other current settings. It has been known that even when cookies are disabled, fingerprints can be used to fully or partially identify users or devices. In this communication paper, a new insight into the challenge of browser fingerprint is encouraged as a new venture. Thus, the initial way to truly understand the browser fingerprint is the need to collect browser fingerprints. In this work, the process of data collection for browser fingerprinting through scripting, to offer a complete all-in-one fingerprinting test suite, has been thoughtfully divided into appropriate sections and grouped with key information to be carried out. The objective is to gather fingerprint data with no personal identification information and make it an open source of raw datasets in the industry for any future research purposes. To our best knowledge, there are no open datasets made available for browser fingerprints in the research field. The dataset will be widely accessible by anyone interested in obtaining those data. The dataset collected will be very raw and will be in the form of a text file. Thus, the main contribution of this work is to share an open dataset of browser fingerprints along with its collection methodology.

ChronoEOS 2.0: Device Fingerprinting and EOSIO Blockchain Technology for On-Running Forensic Analysis in an IoT Environment

In industrial environments there are critical devices, so their correct operation must be ensured. In particular, having a secure record of the different events related to these devices is essential. Thus, this record can be used in future forensic investigations in case of accidents or production failures. In this sense, blockchain technology can bring reliability to the event log. In this paper, ChronoEOS 2.0, an extension of ChronoEOS, is presented. This new version can record the events that occur in multiple industrial robotic arms by deploying a Smart Contract in the EOSIO blockchain so that all events are immutably recorded in the blockchain. Furthermore, the new version allows using a unique fingerprint of the robot before registering an event in the blockchain. This fingerprint depends only on the characteristics of the operation and configuration of the robot. For this reason, ChronoEOS 2.0 not only increase the ability of ChronoEOS in terms of handling multiple devices but also increases the security and reliability of the operations. Finally, in this study, we verify that the new improvements have little impact on the hosting resources (RAM and Network are not altered, while CPU consumption is slightly higher due to the device fingerprinting module).

Device identification using optimized digital footprints

<span lang="EN-US">The rapidly increasing number of internet of things (IoT) and non-IoT devices has imposed new security challenges to network administrators. Accurate device identification in the increasingly complex network structures is necessary. In this paper, a device fingerprinting (DFP) method has been proposed for device identification, based on digital footprints, which devices use for communication over a network. A subset of nine features have been selected from the network and transport layers of a single transmission control protocol/internet protocol packet based on attribute evaluators in Weka, to generate device-specific signatures. The method has been evaluated on two online datasets, and an experimental dataset, using different supervised machine learning (ML) algorithms. Results have shown that the method is able to distinguish device type with up to 100% precision using the random forest (RF) classifier, and classify individual devices with up to 95.7% precision. These results demonstrate the applicability of the proposed DFP method for device identification, in order to provide a more secure and robust network.</span>

PRNU-based Image Forgery Localization with Deep Multi-scale Fusion

Photo-response non-uniformity (PRNU), as a class of device fingerprint, plays a key role in the forgery detection/localization for visual media. The state-of-the-art PRNU-based forensics methods generally rely on the multi-scale trace analysis and result fusion, with Markov random field model. However, such hand-crafted strategies are difficult to provide satisfactory multi-scale decision, exhibiting a high false-positive rate. Motivated by this, we propose an end-to-end multi-scale decision fusion strategy, where a mapping from multi-scale forgery probabilities to binary decision is achieved by a supervised deep fully connected neural network. As the first time, the deep learning technology is employed in PRNU-based forensics for more flexible and reliable integration of multi-scale information. The benchmark experiments exhibit the state-of-the-art accuracy performance of our method in both pixel-level and image-level, especially for false positives. Additional robustness experiments also demonstrate the benefits of the proposed method in resisting noise and compression attacks.

Trust assessment for mobile crowdsensing via device fingerprinting

Mobile crowdsensing leverages the ubiquitous sensors of smart devices to facilitate various sensing applications. Users who participate in contributing data usually get rewards from the task requester, while there is a potential risk that someone would preempt the task and provide a forged sensing report for seeking revenue with minimal effort. Thus, trust assessment is essential to identify those irregular sensing reports. The existing methods mainly consider users’ reputations and estimate the trustworthiness upon the difference from the aggregated result. However, they still face a severe problem when a majority of reports are invalid or low-quality caused by the repeated submission, e.g., a user can switch multiple accounts on a single device to repeatedly submit forged reports. To tackle this problem, we design a trust assessment scheme with an enhanced device fingerprinting algorithm. Briefly, to reduce the influence of the repeated sensing reports, we first compute their unique fingerprints derived from the intrinsic characteristics of sensors and assign an initial trust weight for each report. Then, to improve the accuracy of the assessment, we further compute the similarity of the reports to obtain their final trust values. Extensive evaluations are conducted to justify the effectiveness of our proposed design.

Development of Fingerprint Identification Based on Device Flow in Industrial Control System

With the rapid development of industrial automation technology, a large number of industrial control devices have emerged in cyberspace, but the security of open cyberspace is difficult to guarantee. Attacks on industrial control devices can directly endanger the environment and even life safety. Therefore, how to monitor the industrial control system in real time has become the primary problem, and device identification is the basic guarantee of safety monitoring. There are limitations in building device identification model based on IP address or machine learning. The paper aim at the development of a device traffic fingerprint model and identify the device based on the periodicity of device traffic. The model generates device fingerprints based on pattern sequences abstracted from the traffic and suffix array algorithm. In the process of recognition, the exact pattern matching algorithm is used for preliminary judgment. If the exact pattern matching fails to hit, the final judgment is made by combination fuzzy pattern matching. This paper also proposes a diagonal jump algorithm to optimize the updating of the distance matrix, which saves on the computational cost of fuzzy pattern matching. Simulation results show that compared with SVM, random forest, and LSTM model, the device traffic fingerprint model has good performance advantages in accuracy, recall and precision.

Passive Fingerprinting of Same-Model Electrical Devices by Current Consumption.

One possible device authentication method is based on device fingerprints, such as software- or hardware-based unique characteristics. In this paper, we propose a fingerprinting technique based on passive externally measured information, i.e., current consumption from the electrical network. The key insight is that small hardware discrepancies naturally exist even between same-electrical-circuit devices, making it feasible to identify slight variations in the consumed current under steady-state conditions. An experimental database of current consumption signals of two similar groups containing 20 same-model computer displays was collected. The resulting signals were classified using various state-of-the-art time-series classification (TSC) methods. We successfully identified 40 similar (same-model) electrical devices with about 94% precision, while most errors were concentrated in confusion between a small number of devices. A simplified empirical wavelet transform (EWT) paired with a linear discriminant analysis (LDA) classifier was shown to be the recommended classification method.

Impact of Real Time Fraud Prevention on Online Resale Platform using Machine Learning and Device Fingerprint Techniques

Impact of Real Time Fraud Prevention on Online Resale Platform using Machine Learning and Device Fingerprint Techniques

Deep Learning Model Portability for Domain-Agnostic Device Fingerprinting

Deep Learning Model Portability for Domain-Agnostic Device Fingerprinting

Geometric Distortion Correction of Images Received From Biometric Fingerprint Devices

The quality of fingerprint images is very important for recognition and identification in biometric systems. Geometric distortions and different image scales may worsen fingerprint recognition. It is necessary to adjust distortions and scale in biometric finger capture systems. Algorithms for correcting distortions and scale are investigated, analyzed, and developed in this paper. A polynomial model of second order is used as a mathematical model of spatial distortions. To correct the brightness of image points, bicubic interpolation is used.

Improvement and Cryptanalysis of a Physically Unclonable Functions Based Authentication Scheme for Smart Grids

Authentication protocols are often used in smart grids to deliver the necessary level of security. A huge number of clients in such a system, however, provides the attacker with the ability to clone them, for example. Device fingerprints, or Physically Unclonable Functions (PUF), have been investigated as an authentication feature to thwart such attacks. In order to accomplish the necessary security in smart grid neighborhood area network communications and to prevent unwanted physical access to smart meters, a former study designed a lightweight authentication system in this way. The suggested protocol uses PUFs to reduce physical attacks. As a consequence, the server/meter impersonation attack is one of the many assaults that this protocol is thought to be secure against. On the other hand, it is generally acknowledged that no security solution should be trusted unless its security has been verified by independent researchers. As a result, this paper assesses the security of this protocol against a typical adversary who has access to or influences over the messages carried over the public channel. This study demonstrates that the attacker is simply capable of impersonating the server for the meter and vice versa. In addition, the suggested attacks desynchronize them, making the adversary the only one capable of interacting with the meter in the role of the legal server rather than the latter. Each of the proposed attacks is extremely effective, and their success probability is almost 1. Finally, a modification is suggested that successfully fixes the protocol’s security weaknesses. The security proof of the improved protocol has been done through the Scyther tool. The computational cost comparison shows that the overhead of the proposed protocol compared to the former scheme is 4.85%, while it withstands various attacks, including traceability, desynchronization, impersonation, man-in-the-middle, and secret disclosure attacks.

Randomized Moving Target Approach for MAC-Layer Spoofing Detection and Prevention in IoT Systems

MAC-layer spoofing, also known as identity spoofing, is recognized as a serious problem in many practical wireless systems. IoT systems are particularly vulnerable to this type of attack as IoT devices (due to their various limitations) are often incapable of deploying advanced MAC-layer spoofing prevention and detection techniques, such as cryptographic authentication. Signal-level device fingerprinting is an approach to identity spoofing detection that is highly suitable for sensor-based IoT networks but can be also utilized in many other types of wireless systems. Previous research works on signal-level device fingerprinting have been based on rather simplistic assumptions about both the adversary’s behavior and the operation of the defense system. The goal of our work was to examine the effectiveness of a novel system that combines signal-level device fingerprinting with the principles of Randomized Moving Target Defense (RMTD) when dealing with a very advanced adversary. The obtained results show that our RMTD-enhanced signal-level device fingerprinting technique exhibits far superior defense performance over the non-RMTD techniques previously discussed in the literature and, as such, could be of great value for practical wireless systems subjected to identity spoofing attacks. We have also introduced a novel proof-of-concept adaptive parameter tuning approach for system practitioners with the ability to encode their risk profile and compute the most efficient hyper-parameters of our proposed defense system.

Fingerprint Based Voting System

Biometric Finger print devices are used in the Electronic Voting machine for voter verification. We have designed a finger print based voting machine where there is no need for the user to carry their government ID. The voter at the polling booth needs only to place their Finger on the device, thus allowing the acquisition of an on-spot fingerprint from the voter which serves as an identification. This Finger print reader reads the details from the tag. This data is passed onto the controlling unit for the verification. The controller fetches the data from the reader and compares this data with the already existing data stored during the registration of the voters. If the data matches with the pre-stored information of the registered fingerprint, the person is allowed to cast his vote. If not, a warning message is displayed on LCD and the person is barred from polling his vote. The vote casting mechanism is carried out manually. LCD is used to display the related messages, warnings and ensuing results.

Research of potential data leaks in information and communication systems

This article discusses the problem of ensuring the protection of user data in information systems. It is shown that classic information systems are represented by stationary and mobile communication devices focused on data exchange with digital space. The fundamental principles of user data exchange in the digital space are considered. It has been established that leading technology IT corporations collect data from user communication devices. It is shown that the organization of data collection is carried out by redirecting the DNS traffic of the communication device to the DNS servers of IT corporations, followed by its encryption using the DoH protocol. This makes it impossible for authorized services and departments of national states to control the users’ DNS traffic and ensures the monopoly position of IT corporations in the global digital market for collecting and analyzing user data. It is shown that the collection of user data is carried out with the aim of further monetization and influencing decisions made by users. DNS traffic of devices for communication with the digital space of the Internet is fixed. An audit of the recorded DNS traffic was performed, and as a result, specialized Internet resources were identified to be responsible for collecting and processing user data. It has been proved that the identified specialized Internet resources belong to IT corporations. Methods of identification of communication devices in digital space were considered. It is shown that the identification of communication devices is based on the collection of a unique set of data from each communication device. Based on each unique data set, a digital fingerprint of the communication device is formed, which is used for its further identification in the digital space. These approaches allow organizing protection against user data collection in information systems. Software and hardware implementations for protection against data collection from communication devices are proposed. It has been experimentally established that the combined use of the proposed software and hardware models provides the most effective protection against data collection from communication devices and does not affect the functionality of information systems.

A Survey of Browser Fingerprint Research and Application

With the development of modern browsing, the convenience brought by rich browser features has also produced a large number of features, which are called browser fingerprints. This article surveys the latest research results on browser fingerprinting, hoping to provide a convenient navigation for newcomers to research or apply this technology in the future. This paper first briefly introduces the browser fingerprinting technology itself, then classifies the related research on browsers, and analyzes the development of different research directions of browser fingerprinting in detail. And through the analysis of the existing results, the problems faced by different research directions are pointed out. After that, this paper introduces the application of browser fingerprint technology in detail and discusses the application achievements and technical challenges of this technology. Next, this paper introduces the theoretical tools related to the research of browser fingerprinting technology and introduces the application of different theoretical tools and practical significance. Finally, the research achievements of browser fingerprint recognition are summarized, and the future development trend is pointed out.

IoT Device Identification Using Directional Packet Length Sequences and 1D-CNN

With the large-scale application of the Internet of Things (IoT), security issues have become increasingly prominent. Device identification is an effective way to secure IoT environment by quickly identifying the category or model of devices in the network. Currently, the passive fingerprinting method used for IoT device identification based on network traffic flow mostly focuses on protocol features in packet headers but does not consider the direction and length of packet sequences. This paper proposes a device identification method for the IoT based on directional packet length sequences in network flows and a deep convolutional neural network. Each value in a packet length sequence represents the size and transmission direction of the corresponding packet. This method constructs device fingerprints from packet length sequences and uses convolutional layers to extract deep features from the device fingerprints. Experimental results show that this method can effectively recognize device identity with accuracy, recall, precision, and f1-score over 99%. Compared with methods using traditional machine learning and feature extraction techniques, our feature representation is more intuitive, and the classification model is effective.

Beyond PRNU: Learning Robust Device-Specific Fingerprint for Source Camera Identification.

Source-camera identification tools assist image forensics investigators to associate an image with a camera. The Photo Response Non-Uniformity (PRNU) noise pattern caused by sensor imperfections has been proven to be an effective way to identify the source camera. However, the PRNU is susceptible to camera settings, scene details, image processing operations (e.g., simple low-pass filtering or JPEG compression), and counter-forensic attacks. A forensic investigator unaware of malicious counter-forensic attacks or incidental image manipulation is at risk of being misled. The spatial synchronization requirement during the matching of two PRNUs also represents a major limitation of the PRNU. To address the PRNU’s fragility issue, in recent years, deep learning-based data-driven approaches have been developed to identify source-camera models. However, the source information learned by existing deep learning models is not able to distinguish individual cameras of the same model. In light of the vulnerabilities of the PRNU fingerprint and data-driven techniques, in this paper, we bring to light the existence of a new robust data-driven device-specific fingerprint in digital images that is capable of identifying individual cameras of the same model in practical forensic scenarios. We discover that the new device fingerprint is location-independent, stochastic, and globally available, which resolves the spatial synchronization issue. Unlike the PRNU, which resides in the high-frequency band, the new device fingerprint is extracted from the low- and mid-frequency bands, which resolves the fragility issue that the PRNU is unable to contend with. Our experiments on various datasets also demonstrate that the new fingerprint is highly resilient to image manipulations such as rotation, gamma correction, and aggressive JPEG compression.

BLS-identification: A device fingerprint classification mechanism based on broad learning for Internet of Things

The popularity of the Internet of Things (IoT) has enabled a large number of vulnerable devices to connect to the Internet, bringing huge security risks. As a network-level security authentication method, device fingerprint based on machine learning has attracted considerable attention because it can detect vulnerable devices in complex and heterogeneous access phases. However, flexible and diversified IoT devices with limited resources increase difficulty of the device fingerprint authentication method executed in IoT, because it needs to retrain the model network to deal with incremental features or types. To address this problem, a device fingerprinting mechanism based on a Broad Learning System (BLS) is proposed in this paper. The mechanism firstly characterizes IoT devices by traffic analysis based on the identifiable differences of the traffic data of IoT devices, and extracts feature parameters of the traffic packets. A hierarchical hybrid sampling method is designed at the preprocessing phase to improve the imbalanced data distribution and reconstruct the fingerprint dataset. The complexity of the dataset is reduced using Principal Component Analysis (PCA) and the device type is identified by training weights using BLS. The experimental results show that the proposed method can achieve state-of-the-art accuracy and spend less training time than other existing methods.

Biometric Vehicle Ignition System

Abstract: The project's purpose is to develop a smart ignition security system. A fingerprint sensor is used for motorcycle access in the proposed system, and a relay will be used for controlling ignition. The fingerprint sensor is a dependable fingerprint sensor that collects accurate fingerprint data. For added convenience and security, it's designed to fit inside electrical devices. The device, which is secure, fast, and easy to use, replaces credentials, PINs, and other types of user authentication. The system's principal controlling device is a microcontroller. A fingerprints sensor, a relay, as well as an LCD display are all included. The Micro - controller acts as something of a passcode to the ignition if the fingerprint device's input is legitimate. The status will be displayed on the LCD. This brilliant achievement is accomplished with the help of a microcontroller. The micro - controller grants access to the ignition switch if the information from the fingerprint scanner is valid. The information is displayed on the LCD. A pic micro-controller with a strong c software developed in embedded 'C' code is used to carry out this innovative activity. If the user cannot be identified, the cam32 modules is triggered, which takes an image of them and transmits it to the owner.