IoT Device Identification Research Articles

A comparative analysis of feature selection for IoT device identification in machine learning algorithms

A comparative analysis of feature selection for IoT device identification in machine learning algorithms

Identification of IoT Devices Based on Hardware and Software Fingerprint Features

Identification of IoT Devices Based on Hardware and Software Fingerprint Features

BitIoT: A Bit Level Deep Packet Inspection Method for Identification of MQTT-Based IoT Devices in the Wild

BitIoT: A Bit Level Deep Packet Inspection Method for Identification of MQTT-Based IoT Devices in the Wild

Stimulated Microcontroller Dataset for New IoT Device Identification Schemes through On-Chip Sensor Monitoring

Legitimate identification of devices is crucial to ensure the security of present and future IoT ecosystems. In this regard, AI-based systems that exploit intrinsic hardware variations have gained notable relevance. Within this context, on-chip sensors included for monitoring purposes in a wide range of SoCs remain almost unexplored, despite their potential as a valuable source of both information and variability. In this work, we introduce and release a dataset comprising data collected from the on-chip temperature and voltage sensors of 20 microcontroller-based boards from the STM32L family. These boards were stimulated with five different algorithms, as workloads to elicit diverse responses. The dataset consists of five acquisitions (1.3 billion readouts) that are spaced over time and were obtained under different configurations using an automated platform. The raw dataset is publicly available, along with metadata and scripts developed to generate pre-processed T–V sequence sets. Finally, a proof of concept consisting of training a simple model is presented to demonstrate the feasibility of the identification system based on these data.

Type classification and identification of IoT devices by using traffic characteristics

Type classification and identification of IoT devices by using traffic characteristics

Transferability of Machine Learning Algorithm for IoT Device Profiling and Identification

Transferability of Machine Learning Algorithm for IoT Device Profiling and Identification

IoT Device Identification and Cybersecurity: Advancements, Challenges, and an LSTM-MLP Solution

Over the past few years, there has been an undeniable surge in the deployment of IoT devices. However, this rapid growth has brought new challenges in cybersecurity, as unauthorized device deployment, malicious code modification, malware deployment, and vulnerability exploitation have emerged as significant issues. As a result, there is a growing need for device identification mechanisms based on behavior monitoring. To address these challenges, Machine Learning (ML) and Deep Learning (DL) techniques have been increasingly employed due to advances in the field and improved processing capabilities. However, cyber attackers have developed adversarial attacks that focus on modifying contexts and evading ML evaluations applied to IoT device identification solutions. This article highlights the importance of addressing cybersecurity challenges in the IoT landscape and proposes a hardware behavior-based individual device identification approach using an LSTM-MLP architecture. The proposed architecture was compared to the most common ML/DL classification techniques using data collected from 45 Raspberry Pi devices running identical software and showing promising results in improving device identification. The proposed LSTM-MLP method outperformed previous solutions, achieving an average increase in F1-Score of +0.97 and a minimum TPR of 0.97 for all devices.

Adversarial attacks and defenses on ML- and hardware-based IoT device fingerprinting and identification

In the last years, the number of IoT devices deployed has suffered an undoubted explosion, reaching the scale of billions. However, some new cybersecurity issues have appeared together with this development. Some of these issues are the deployment of unauthorized devices, malicious code modification, malware deployment, or vulnerability exploitation. This fact has motivated the requirement for new device identification mechanisms based on behavior monitoring. Besides, these solutions have recently leveraged Machine and Deep Learning (ML/DL) techniques due to the advances in this field and the increase in processing capabilities. In contrast, attackers do not stay stalled and have developed adversarial attacks focused on context modification and ML/DL evaluation evasion applied to IoT device identification solutions. However, literature has not yet analyzed in detail the impact of these attacks on individual identification solutions and their countermeasures. This work explores the performance of hardware behavior-based individual device identification, how it is affected by possible context- and ML/DL-focused attacks, and how its resilience can be improved using defense techniques. In this sense, it proposes an LSTM-CNN architecture based on hardware performance behavior for individual device identification. Then, the most usual ML/DL classification techniques have been compared with the proposed architecture using a hardware performance dataset collected from 45 Raspberry Pi devices running identical software. The LSTM-CNN improves previous solutions achieving a ＋0.96 average F1-Score and 0.8 minimum TPR for all devices. Afterward, context- and ML/DL-focused adversarial attacks were applied against the previous model to test its robustness. A temperature-based context attack was not able to disrupt the identification, but some ML/DL state-of-the-art evasion attacks were successful. Finally, adversarial training and model distillation defense techniques are selected to improve the model resilience to evasion attacks, improving its robustness from up to 0.88 attack success ratio to 0.17 in the worst attack case, without degrading its performance in an impactful manner.

AutoIoT: Automatically Updated IoT Device Identification With Semi-Supervised Learning

<i>AutoIoT</i>: Automatically Updated IoT Device Identification With Semi-Supervised Learning

FL4IoT: IoT Device Fingerprinting and Identification Using Federated Learning

Unidentified devices in a network can result in devastating consequences. It is, therefore, necessary to fingerprint and identify IoT devices connected to private or critical networks. With the proliferation of massive but heterogeneous IoT devices, it is getting challenging to detect vulnerable devices connected to networks. Current machine learning-based techniques for fingerprinting and identifying devices necessitate a significant amount of data gathered from IoT networks that must be transmitted to a central cloud. Nevertheless, private IoT data cannot be shared with the central cloud in numerous sensitive scenarios. Federated learning (FL) has been regarded as a promising paradigm for decentralized learning and has been applied in many different use cases. It enables machine learning models to be trained in a privacy-preserving way. In this article, we propose a privacy-preserved IoT device fingerprinting and identification mechanisms using FL; we call it FL4IoT. FL4IoT is a two-phased system combining unsupervised-learning-based device fingerprinting and supervised-learning-based device identification. FL4IoT shows its practicality in different performance metrics in a federated and centralized setup. For instance, in the best cases, empirical results show that FL4IoT achieves ∼99% accuracy and F1-Score in identifying IoT devices using a federated setup without exposing any private data to a centralized cloud entity. In addition, FL4IoT can detect spoofed devices with over 99% accuracy .

Adversarial Attacks Against IoT Identification Systems

While machine learning-based solutions for IoT device identification are effective in identifying IoT devices connected to the network, they may be vulnerable to adversarial attacks. Conventional approaches for crafting adversarial attacks from the computer vision (CV) domain are not applicable in the computer network domain as they interfere with the meaningful communication of devices. In this research, we evaluate the robustness of payload-based IoT device identification solutions against adversarial examples generated using our new approach for the real-time crafting of adversarial examples; this approach, which is also applicable to the computer network domain, uses heatmaps generated by class activation mapping (CAM) and Grad-CAM++. We evaluate the effectiveness of adversarial examples generated using the above two methods against six variants of an existing payload-based machine learning IoT identification solution in a real-time end-to-end scenario. We show that in many cases, an adversarial example crafted using a heatmap can fool the examined variants of an existing payload-based IoT device identification solution with up to 100% accuracy.

Automatic IoT device identification: a deep learning based approach using graphic traffic characteristics

Automatic IoT device identification: a deep learning based approach using graphic traffic characteristics

HFedDI: A novel privacy preserving horizontal federated learning based scheme for IoT device identification

As the number of IoT devices that are getting connected to the Internet is increasing, there is a need to automatically detect the IoT devices connected to the network for efficient network resource management and planning, identification of security attacks and anomalies in the network. Centralized machine learning techniques for device identification lead to the use of excessive communication bandwidth and can at times lead to privacy issues as data has to be transported to the central location. In this paper, we propose HFedDI- a novel horizontal learning based federated learning scheme for IoT device identification. The proposed federated learning technique is scalable as an edge device that does device identification can identify the devices which were never connected to it previously due to the achieved generalization accuracy as a result of model updates from other edge devices. Our work has indicated significant performance improvement in device identification across IID scenarios, and non-IID (specifically tested for data and label distribution skew) scenarios when tested on three publically available datasets. The proposed device identification technique is privacy preserving and is promising as the existing work in literature which utilized federated learning for other applications has indicated very poor results under non-IID label skew scenarios.

IoT-Portrait: Automatically Identifying IoT Devices via Transformer with Incremental Learning

With the development of IoT, IoT devices have proliferated. With the increasing demands of network management and security evaluation, automatic identification of IoT devices becomes necessary. However, existing works require a lot of manual effort and face the challenge of catastrophic forgetting. In this paper, we propose IoT-Portrait, an automatic IoT device identification framework based on a transformer network. IoT-Portrait automatically acquires information about IoT devices as labels and learns the traffic behavior characteristics of devices through a transformer neural network. Furthermore, for privacy protection and overhead reasons, it is not easy to save all past samples to retrain the classification model when new devices join the network. Therefore, we use a class incremental learning method to train the new model to preserve old classes’ features while learning new devices’ features. We implement a prototype of IoT-Portrait based on our lab environment and open-source database. Experimental results show that IoT-Portrait achieves a high identification rate of up to 99% and is well resistant to catastrophic forgetting with a negligible added cost both in memory and time. It indicates that IoT-Portrait can classify IoT devices effectively and continuously.

IoTTFID: An Incremental IoT Device Identification Model Based on Traffic Fingerprint

IoTTFID: An Incremental IoT Device Identification Model Based on Traffic Fingerprint

IoTDevID: A Behavior-Based Device Identification Method for the IoT

Device identification is one way to secure a network of IoT devices, whereby devices identified as suspicious can subsequently be isolated from a network. In this study, we present a machine learning-based method, IoTDevID, that recognizes devices through characteristics of their network packets. As a result of using a rigorous feature analysis and selection process, our study offers a generalizable and realistic approach to modelling device behavior, achieving high predictive accuracy across two public datasets. The model's underlying feature set is shown to be more predictive than existing feature sets used for device identification, and is shown to generalize to data unseen during the feature selection process. Unlike most existing approaches to IoT device identification, IoTDevID is able to detect devices using non-IP and low-energy protocols.

EvoIoT: An evolutionary IoT and non-IoT classification model in open environments

IoT device identification is essential for both device asset management and security management. IoT device identification in open environments is the key to its application in real environments, where IoT and non-IoT device identification is the first and critical step. However, existing methods are either not applicable to open environments or have poor scalability and sustainability for IoT and non-IoT device identification. This paper presents EvoIoT, an IoT and non-IoT identification model designed to apply in open environments with high scalability and the ability to run sustainably and effectively. EvoIoT achieves high scalability by applying a unified model for all devices. To mine discriminative features from encrypted traffic, EvoIoT extracts original features from packet headers and judges feature importance in the entire model update process. For sustainability, EvoIoT proposes a representative device choosing method and model update method to address the concept drift caused by new types of devices. EvoIoT is the first high-performance model that systematically addresses the IoT and non-IoT device classification problem. We evaluate EvoIoT on two public datasets and a private dataset collected from a laboratory setting. The evaluation results show that EvoIoT is on average 6.27%∼48.89% more accurate than state-of-the-art methods.

IoT device identification based on network communication analysis using deep learning

IoT device identification based on network communication analysis using deep learning

A Cloud Based Framework for Identification of IoT Devices at Smart Home Using Supervised Machine Intelligence Model

A Cloud Based Framework for Identification of IoT Devices at Smart Home Using Supervised Machine Intelligence Model

Machine Learning for the Detection and Identification of Internet of Things Devices: A Survey

The Internet of Things (IoT) is becoming an indispensable part of everyday life, enabling a variety of emerging services and applications. However, the presence of rogue IoT devices has exposed the IoT to untold risks with severe consequences. The first step in securing the IoT is detecting rogue IoT devices and identifying legitimate ones. Conventional approaches use cryptographic mechanisms to authenticate and verify legitimate devices’ identities. However, cryptographic protocols are not available in many systems. Meanwhile, these methods are less effective when legitimate devices can be exploited or encryption keys are disclosed. Therefore, noncryptographic IoT-device identification and rogue device detection become efficient solutions to secure existing systems and will provide additional protection to systems with cryptographic protocols. Noncryptographic approaches require more effort and are not yet adequately investigated. In this article, we provide a comprehensive survey on machine learning technologies for the identification of IoT devices along with the detection of compromised or falsified ones from the viewpoint of passive surveillance agents or network operators. We classify the IoT-device identification and detection into four categories: 1) device-specific pattern recognition; 2) deep learning-enabled device identification; 3) unsupervised device identification; and 4) abnormal device detection. Meanwhile, we discuss various ML-related enabling technologies for this purpose. These enabling technologies include learning algorithms, feature engineering on network traffic traces and wireless signals, incremental learning, and abnormality detection.