Device Fingerprinting Research Articles

Toward the flow-centric detection of browser fingerprinting

Browser fingerprinting has become a prevalent technique employed by websites for advertising and analytics. It utilizes JavaScript objects and APIs to gather traditional and non-traditional browser attributes and creates unique identifiers for online user tracking. While previous research has examined the invocation of the browser's built-in JavaScript objects and APIs to retrieve browser attribute values, it overlooks the use and flow of those values within scripts.In this paper, we define browser fingerprinting behavior as the aggregation of different types of browser attributes, and reduce the detection of browser fingerprinting to a joint analysis of the data flows of browser attribute values in JavaScript code. FProbe, our proposed framework for the flow-centric detection of browser fingerprinting, performs context-sensitive static data flow analysis on JavaScript code. Given the complexity and dynamic features of the JavaScript language, achieving soundness in static analysis of JavaScript code is extremely challenging or even impossible. Consequently, FProbe aims to be a practical and accurate tool for detecting browser fingerprinting. We implemented FProbe in Java and evaluated its performance using 4,296 fingerprinting scripts from recent work and 2,335,317 pieces of JavaScript code on 988,220 websites. FProbe achieved F-measures of 97.81% and 96.31% on these datasets, respectively. It identified browser fingerprinting behavior on 0.78% of the 988,220 websites, with the use of the toDataURL method observed in 4.26% of the fingerprinting scripts. Notably, only 72 fingerprinting scripts and 10 fingerprinting providers identified by FProbe were reported in previous work. These results highlight the effectiveness of FProbe in detecting browser fingerprinting and its complementarity to existing detection tools. Additionally, our comprehensive study demonstrates that fingerprinting with traditional browser attributes can achieve a 96.6% F-measure.

TEA-RFFI: Temperature adjusted radio frequency fingerprint-based smartphone identification

Recently, radio frequency fingerprints (RFFs) have been widely applied for smartphone identification, since RFFs are distinguishable and hard to imitate. Compared with other types of RFFs, carrier frequency offset (CFO) in Wi-Fi signals is more robust and practical. However, when many smartphones need to be identified, the probability of CFO collision is high due to the weak distinguishability of CFO, and thus the primitive CFO-based identification solution will perform poorly. Fortunately, we find that the CFO varies with crystal oscillator temperature. Inspired by the phenomenon, we can actively adjust the crystal oscillator temperature to increase the difference between Wi-Fi device fingerprints for CFO collision mitigation. Firstly, we propose a non-intrusive temperature sensing and adjustment solution, which can obtain crystal oscillator temperature accurately and actively adjust its temperature to specified values without any additional hardware. Then, we investigate the temperature selection problem which aims to maximize overall differences among all smartphones, and propose the corresponding algorithm that combines greedy strategy and simulated annealing to assign a proper temperature value to each smartphone for identification. Finally, we implement the TEA-RFFI system and conduct several sets of experiments under the cases of different positions, time periods and scenarios. Experimental results demonstrate that TEA-RFFI can effectively identify 20 smartphones with over 90% precision, recall and F1-score. Even when the smartphones are moving, our proposed system still can identify them with over 89% precision, recall and F1-score.

A Review of User Identification Methods Based on Digital Fingerprint

Methods of user identification based on digital fingerprints are considered. The main approaches for the browser fingerprints creation which is installed on the user's device and characterizes the device belonging to the user are presented. The methods used to identify a person (user) during the operation of the device are also described. Methods using both the dynamics of keystrokes and interactions with the touch screen, voice and geolocation data, as well as behavioral biometrics and behavioral profile are presented. The concept of continuous authentication is described as a development of the identification approach. A list of publicly available data sets mentioned in the studies reviewed in the review is provided, with links to download them.

Adversarial attacks and defenses on ML- and hardware-based IoT device fingerprinting and identification

In the last years, the number of IoT devices deployed has suffered an undoubted explosion, reaching the scale of billions. However, some new cybersecurity issues have appeared together with this development. Some of these issues are the deployment of unauthorized devices, malicious code modification, malware deployment, or vulnerability exploitation. This fact has motivated the requirement for new device identification mechanisms based on behavior monitoring. Besides, these solutions have recently leveraged Machine and Deep Learning (ML/DL) techniques due to the advances in this field and the increase in processing capabilities. In contrast, attackers do not stay stalled and have developed adversarial attacks focused on context modification and ML/DL evaluation evasion applied to IoT device identification solutions. However, literature has not yet analyzed in detail the impact of these attacks on individual identification solutions and their countermeasures. This work explores the performance of hardware behavior-based individual device identification, how it is affected by possible context- and ML/DL-focused attacks, and how its resilience can be improved using defense techniques. In this sense, it proposes an LSTM-CNN architecture based on hardware performance behavior for individual device identification. Then, the most usual ML/DL classification techniques have been compared with the proposed architecture using a hardware performance dataset collected from 45 Raspberry Pi devices running identical software. The LSTM-CNN improves previous solutions achieving a ＋0.96 average F1-Score and 0.8 minimum TPR for all devices. Afterward, context- and ML/DL-focused adversarial attacks were applied against the previous model to test its robustness. A temperature-based context attack was not able to disrupt the identification, but some ML/DL state-of-the-art evasion attacks were successful. Finally, adversarial training and model distillation defense techniques are selected to improve the model resilience to evasion attacks, improving its robustness from up to 0.88 attack success ratio to 0.17 in the worst attack case, without degrading its performance in an impactful manner.

Toward Automatically Connecting IoT Devices with Vulnerabilities in the Wild

With the increasing number of Internet of Things (IoT) devices connected to the internet, the industry and research community have become increasingly concerned about their security impact. Adversaries or hackers often exploit public security flaws to compromise IoT devices and launch cyber attacks. However, despite this growing concern, little effort has been made to investigate the detection of IoT devices and their underlying risks. To address this gap, this article proposes to automatically establish relationships between IoT devices and their vulnerabilities in the wild. Specifically, we construct a deep neural network (DNN) to extract semantic information from IoT packets and generate fine-grained fingerprints of IoT devices. This enables us to annotate IoT devices in cyberspace, including their device type, vendor, and product information. We collect vulnerability reports from various security sources and extract IoT device information from these reports to automatically match vulnerabilities with the fingerprints of IoT devices. We implemented a prototype system and conducted extensive experiments to validate the effectiveness of our approach. The results show that our DNN model achieved a 98% precision rate and a 95% recall rate in IoT device fingerprinting. Furthermore, we collected and analyzed over 13,063 IoT-related vulnerability reports and our method automatically built 5,458 connections between IoT device fingerprints and their vulnerabilities. These findings shed light on the ongoing threat of cyber-attacks on IoT systems as both IoT devices and disclosed vulnerabilities are targets for malicious attackers.

Self-supervised learning for clustering of wireless spectrum activity

In recent years, much work has been done on processing of wireless spectrum data involving machine learning techniques in domain-related problems for cognitive radio networks, such as anomaly detection, modulation classification, technology classification and device fingerprinting. Most of the solutions are based on labeled data, created in a controlled manner and processed with supervised learning approaches. However, spectrum data measured in real-world environment is highly nondeterministic, making its labeling a laborious and expensive process, requiring domain expertise, thus being one of the main drawbacks of using supervised learning approaches in this domain. In this paper, we investigate the utilization of self-supervised learning (SSL) for exploring spectrum activities in a real-world unlabeled data. In particular, we assess the performance of SSL models, based on the reference DeepCluster architecture. We carefully consider the current state-of-the-art feature extractors, taking into account the performance and complexity trade-offs. Our findings demonstrate that SSL models achieve superior performance regarding the feature quality and clustering performance compared to baseline feature learning approaches. With SSL models we achieve significant reduction of the feature vectors size by two orders of magnitude, while improving the performance by a factor ranging from 2 to 2.5 across the evaluation metrics, supported by visual assessment. Furthermore, we showcase how adapting the reference SSL architecture to domain-specific data is followed by a substantial reduction in model complexity up to one order of magnitude, without compromising, and in some cases, even improving the clustering performance.

Bluetooth Low Energy Device Identification Based on Link Layer Broadcast Packet Fingerprinting

With the rapid development of the Internet of Things (IoT), wireless technology has become an indispensable part of modern computing platforms and embedded systems. Wireless device fingerprint identification is deemed as a promising solution towards enhancing the security of device access authentication and communication process in the IoT scenario. However, the extraction of features from the network layer and its upper layers often confront restrictions from specific devices: the association with a certain wireless network and the access to the plaintext of the payload. Meanwhile, Bluetooth Low Energy (BLE) packets have been encrypted above the link layer, which makes those features difficult to extract. To tackle these problems, we introduce a novel method to identify BLE devices based on the fingerprint features in the data link layer. Initially, the BLE packets are collected through a receiver based on software-defined radio technology. Then, fields that reflect device differences in BLE broadcast packets are extracted through traffic analysis. Finally, a MultiLayer Perceptron (MLP) model is employed to recognize the category of BLE devices. An experimental result on a dataset with 15 types of BLE devices shows that the identification accuracy of the proposed method can reach 99.8%, which accomplishes better performance over previous work.

Source Camera Identification with a Robust Device Fingerprint: Evolution from Image-Based to Video-Based Approaches.

With the increasing prevalence of digital multimedia content, the need for reliable and accurate source camera identification has become crucial in applications such as digital forensics. While effective techniques exist for identifying the source camera of images, video-based source identification presents unique challenges due to disruptive effects introduced during video processing, such as compression artifacts and pixel misalignment caused by techniques like video coding and stabilization. These effects render existing approaches, which rely on high-frequency camera fingerprints like Photo Response Non-Uniformity (PRNU), inadequate for video-based identification. To address this challenge, we propose a novel approach that builds upon the image-based source identification technique. Leveraging a global stochastic fingerprint residing in the low- and mid-frequency bands, we exploit its resilience to disruptive effects in the high-frequency bands, envisioning its potential for video-based source identification. Through comprehensive evaluation on recent smartphones dataset, we establish new benchmarks for source camera model and individual device identification, surpassing state-of-the-art techniques. While conventional image-based methods struggle in video contexts, our approach unifies image and video source identification through a single framework powered by the novel non-PRNU device-specific fingerprint. This contribution expands the existing body of knowledge in the field of multimedia forensics.

Leveraging Deep Learning for IoT Transceiver Identification.

With the increasing demand for Internet of Things (IoT) network applications, the lack of adequate identification and authentication has become a significant security concern. Radio frequency fingerprinting techniques, which utilize regular radio traffic as the identification source, were then proposed to provide a more secured identification approach compared to traditional security methods. Such solutions take hardware-level characteristics as device fingerprints to mitigate the risk of pre-shared key leakage and lower computational complexity. However, the existing studies suffer from problems such as location dependence. In this study, we have proposed a novel scheme for further exploiting the spectrogram and the carrier frequency offset (CFO) as identification sources. A convolutional neural network (CNN) is chosen as the classifier. The scheme addressed the location-dependence problem in the existing identification schemes. Experimental evaluations with data collected in the real world have indicated that the proposed approach can achieve 80% accuracy even if the training and testing data are collected on different days and at different locations, which is 13% higher than state-of-the-art approaches.

FL4IoT: IoT Device Fingerprinting and Identification Using Federated Learning

Unidentified devices in a network can result in devastating consequences. It is, therefore, necessary to fingerprint and identify IoT devices connected to private or critical networks. With the proliferation of massive but heterogeneous IoT devices, it is getting challenging to detect vulnerable devices connected to networks. Current machine learning-based techniques for fingerprinting and identifying devices necessitate a significant amount of data gathered from IoT networks that must be transmitted to a central cloud. Nevertheless, private IoT data cannot be shared with the central cloud in numerous sensitive scenarios. Federated learning (FL) has been regarded as a promising paradigm for decentralized learning and has been applied in many different use cases. It enables machine learning models to be trained in a privacy-preserving way. In this article, we propose a privacy-preserved IoT device fingerprinting and identification mechanisms using FL; we call it FL4IoT. FL4IoT is a two-phased system combining unsupervised-learning-based device fingerprinting and supervised-learning-based device identification. FL4IoT shows its practicality in different performance metrics in a federated and centralized setup. For instance, in the best cases, empirical results show that FL4IoT achieves ∼99% accuracy and F1-Score in identifying IoT devices using a federated setup without exposing any private data to a centralized cloud entity. In addition, FL4IoT can detect spoofed devices with over 99% accuracy .

Device Fingerprinting for Cyber-Physical Systems: A Survey

The continued growth of the cyber-physical system (CPS) and Internet of Things technologies raises device security and monitoring concerns. For device identification, authentication, conditioning, and security, device fingerprint/fingerprinting (DFP) is increasingly used. However, finding the correct DFP features and sources to establish a unique and stable fingerprint is challenging. We present a state-of-the-art survey of DFP techniques for CPS device applications. We investigate the numerous DFP features, their origins, characteristics, and applications. Additionally, we discuss the DFP characteristics and their sources in detail, taking into account the physical contexts of various entities (i.e., machines, sensors, networks, and computational devices), as well as their software and applications for the CPS. We believe that this article will provide researchers and developers with insights into the DFP and its applications, sources, aggregation methods, and factors affecting its use in CPS domains.

Deep Learning-Enabled Zero-Touch Device Identification: Mitigating the Impact of Channel Variability Through MIMO Diversity

Deep learning-enabled device fingerprinting has proven efficient in enabling automated identification and authentication of transmitting devices. It does so by leveraging the transmitters' unique features that are inherent to hardware impairments caused during manufacturing to extract device-specific signatures that can be exploited to uniquely distinguish and separate between (identical) devices. Though shown to achieve promising performances, hardware fingerprinting approaches are known to suffer greatly when the training data and the testing data are generated under different channels conditions that often change when time and/or location changes. To the best of our knowledge, this work is the first to use MIMO diversity to mitigate the impact of channel variability and provide a channel-resilient device identification over flat fading channels. Specifically, we show that MIMO can increase the device classification accuracy by up to about 50 percent when model training and testing are done over the same channel and by up to about 70 percent when training and testing are done over different fading channels.

Mobile Communication Among COTS IoT Devices via a Resonant Gyroscope With Ultrasound

Incompatible protocols and electromagnetic interference obstruct the realization of an everything-connected Internet of Things (IoT) communication network. Our system, Deaf-Aid, utilizes a stealthy speaker-to-gyroscope channel to build robust communication. Compared with existing solutions adopting physical covert channels, Deaf-Aid is free from the limitations of manual receiver distinction, additional hardware, conditional placement, or physical contact. It exploits ultrasounds to force gyroscopes embedded in receivers to resonate, so as to convey information. We investigate the relationship among axes in a gyroscope to deal with frequency offset and support multi-channel communication. Meanwhile, receivers are identified automatically via device fingerprints consisting of diversity of gyroscopes’ resonant frequency ranges. Furthermore, we enable Deaf-Aid the capability of mobile communication, which is an essential demand for IoT devices. We address the challenge of recovering accurate signals from motion interference. Extensive evaluations, including that on the commercial off-the-shelf devices, demonstrate that Deaf-Aid yields 47 bps with BER below <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$1\%$</tex-math> </inline-formula> . To our best knowledge, Deaf-Aid is the first work to enable stealthy mobile IoT communication based on inertial sensors.

Privacy-Preserving and Syscall-Based Intrusion Detection System for IoT Spectrum Sensors Affected by Data Falsification Attacks

Crowdsensing platforms collect, process, transmit, and analyze spectrum data worldwide to optimize radio frequency spectrum usage. However, Internet-of-Things (IoT) spectrum sensors, performing some of the previous tasks, are exposed to software manipulation aiming to execute spectrum sensing data falsification (SSDF) attacks to compromise data integrity and spectrum optimization. Novel intrusion detection systems (IDSs) combining device fingerprinting with Machine and Deep Learning (ML/DL) improve the limitation of traditional solutions and remove the necessity of redundant sensors and reputation mechanisms. However, they fail when detecting SSDF attacks accurately while protecting sensors privacy. This work proposes a novel host-based and federated learning-oriented IDS for IoT spectrum sensors that considers unsupervised ML/DL and fingerprints based on system calls. The framework detection performance and consumption of resources are analyzed in local and federated scenarios with six spectrum sensors deployed on Raspberry Pis. The obtained results significantly improve related work when detecting SSDF attacks while protecting sensors privacy, and consuming CPU, memory, and storage of sensors in a reduced manner.

Trusted Access Authentication Technology for Large-Scale Heterogeneous Terminals in a Vehicle Charging Network System

A vehicle charging network system has to access large-scale heterogeneous terminals to collect charging pile status information, which may also give malicious terminals an opportunity to access. Though some general access authentication solutions aimed at only allowing trusted terminals have been proposed, they are difficult to work with in a vehicle charging network system. First, among various heterogeneous terminals with significant differences in computing capabilities, there are inevitably terminals that cannot support computations required for cryptography-based access authentication schemes. Second, though access authentication schemes based on device fingerprints are independent of terminal computing capabilities, their authentication performance is weak in robustness and high in overhead. Third, the access authentication delay is huge since the system cannot withstand heavy concurrent access requests from large-scale terminals. To address the above problems, we propose a reliable and lightweight trusted access authentication solution for terminals in the vehicle charging network system. By cloud, edge, and local servers cooperating to execute authentication tasks, our Cloud-Edge-End Collaborative architecture effectively alleviates the authentication delay caused by high concurrent requests. Each server in the architecture deploys our well-designed unified trusted access authentication (UATT) model based on device fingerprints. With ingenious data construction and the powerful swin-transformer network, the UATT model can provide robust and low-overhead authentication services for heterogeneous terminals. To minimize authentication latency, we further design an A2C-based authentication task scheduling scheme to decide which server executes the current task. Comprehensive experiments demonstrate our solution can authenticate terminals with an accuracy higher than 98% while reducing the required data packets by two orders of magnitude, and it can effectively reduce authentication latency.

Methods for power line communication carrier equipment identity authentication and wiretapping equipment locating considering physical layer characteristics

Power line communication (PLC) faces a wide range of illegal device access, wiretapping and data tampering. To ensure the confidentiality and integrity of data information, protection technologies based on data encryption and identity authentication are widely used. As one of the defense methods against wiretapping attacks, this paper takes into account the characteristics of the physical layer channel, and proposes a method for locating PLC wire-tapping equipment. First, the physical layer channel characteristics are extracted based on the communication protocol as the device fingerprint. Then the collected fingerprints are compared with the fingerprint library for device identity authentication. And when the identity authentication fails, a branch location method for wiretapping devices based on fingerprint transfer vectors is further proposed. Finally, by modeling the PLC channel and simulating eavesdropping scenarios, it is verified that the proposed method has a high accuracy rate of wiretapping equipment locating.

Wi-Fi device identification based on multi-domain physical layer fingerprint

Physical layer fingerprinting is a promising solution for improving the security of Wi-Fi device in Internet of Things (IoT) scenarios, as well as enhancing the usability of Wi-Fi-based applications such as user tracking, accountability, and computer forensics. The existing methods typically require the use of expensive signal analyzers to extract features, which is not conducive to practical engineering implementation and needs improvements in accuracy and speed for wireless devices with complex physical layer modulation. We propose a device fingerprinting technique that utilizes various multi-domain features extracted from the physical layer preamble. These features differ from the signal parts or feature types mostly used in previous works. Furthermore, the robustness of the selected features is evaluated in this paper. Using random forest model to identify the fingerprints, the experimental results show that the accuracy of the proposed scheme can reach 98% for 15 different types of IoT Wi-Fi devices, and 90.76% for 10 network cards with the same type of chips.

Device Fingerprinting and Identification

Device Fingerprinting and Identification

Toward IoT device fingerprinting from proprietary protocol traffic via key-blocks aware approach

IoT Device fingerprinting of network traffic is valuable for many management and security solutions as it provides insights into the devices active on a network. Unfortunately, existing techniques focus on the public (de facto) standard protocol and suffer from low efficiency and high data packet dependence at flow-level granularity. Hence, accurately identifying the types of proprietary-protocol-oriented IoT devices is still a challenge that cannot be ignored. As a solution, we propose DeepFinger, a full-automated, byte-level payload fingerprint generation approach to fill this gap. DeepFinger aims to eliminate the manual intervention required to extract available payload-driven fingerprints, in the absence of priori protocol specification information. The key sight of DeepFinger is that it utilizes deep clustering to automatically cluster similar payloads and infer key-blocks as fingerprints. Through extensive evaluation, we demonstrate that DeepFinger achieves the average TPR with 98.81%, the average FTF with 98.74%, and the average FPR with 0.07% on the dataset containing multiple proprietary protocols. In addition, on three datasets containing public protocols such as MQTT, Modbus, HTTP, and XMPP, DeepFinger also achieved excellent performance by virtue of its extensibility. These results suggest that DeepFinger can be a promising tool for automatizing the payload fingerprint extraction process, based on proprietary protocol assumption.

The Development of a Data Collection and Browser Fingerprinting System

The urgent need to protect user privacy and security has emerged as the World Wide Web has become an increasingly necessary part of daily life. Browser fingerprinting is a very interesting topic in the industry of technology security. New technology will always raise new security issues and browser fingerprinting will undoubtedly follow the same process. It has become one of the most popular topics in online privacy because, to date, there is still no exact solution as to how to stop it entirely. The majority of solutions just aim to reduce the likelihood of obtaining a browser fingerprint. Research on browser fingerprinting is unquestionably required since it is essential to educate users, developers, policymakers, and law enforcement about it so that they can make strategic choices based on knowledge. Browser fingerprinting must be recognised in order to defend against privacy problems. A browser fingerprint is described as data gathered by the receiving server to identify a distant device, and it is different from cookies. Websites frequently utilize browser fingerprinting to obtain information about the type and version of the browser, as well as the operating system, and other current settings. It has been known that even when cookies are disabled, fingerprints can be used to fully or partially identify users or devices. In this communication paper, a new insight into the challenge of browser fingerprint is encouraged as a new venture. Thus, the initial way to truly understand the browser fingerprint is the need to collect browser fingerprints. In this work, the process of data collection for browser fingerprinting through scripting, to offer a complete all-in-one fingerprinting test suite, has been thoughtfully divided into appropriate sections and grouped with key information to be carried out. The objective is to gather fingerprint data with no personal identification information and make it an open source of raw datasets in the industry for any future research purposes. To our best knowledge, there are no open datasets made available for browser fingerprints in the research field. The dataset will be widely accessible by anyone interested in obtaining those data. The dataset collected will be very raw and will be in the form of a text file. Thus, the main contribution of this work is to share an open dataset of browser fingerprints along with its collection methodology.