Network Traffic Analysis based IoT Device Identification

Chowdhury, Rajarshi Roy; Aneja, Sandhya; Aneja, Nagender; Abas, Emeroylariffion

doi:10.1145/3421537.3421545

Cited by 22 publications

(22 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Due to its perceived potential, researchers [5], [6], [11], [14], [15] have been analyzing communication traffic traces of network-connected devices, to extract device-specific fingerprints, which may be used for classification and distinguishing between IoT and non-IoT devices in a network. A set of features can be extracted from the different layers of the communication models [13], through statistical measurements of the packets, either from the packet's payload or protocols information.…”

Section: Related Workmentioning

confidence: 99%

“…Furthermore, the classifier was able to distinguish device type with high accuracy. On the other [11], [20], the researchers presented DFP models for classifying devices using only packet information, whilst 82% and 83.35% accuracies gain with 212 and 161 features, respectively, including source packet length, checksum, and protocol number.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Device identification using optimized digital footprints

Chowdhury

Idris²,

Abas³

2023

IJ-AI

View full text Add to dashboard Cite

<span lang="EN-US">The rapidly increasing number of internet of things (IoT) and non-IoT devices has imposed new security challenges to network administrators. Accurate device identification in the increasingly complex network structures is necessary. In this paper, a device fingerprinting (DFP) method has been proposed for device identification, based on digital footprints, which devices use for communication over a network. A subset of nine features have been selected from the network and transport layers of a single transmission control protocol/internet protocol packet based on attribute evaluators in Weka, to generate device-specific signatures. The method has been evaluated on two online datasets, and an experimental dataset, using different supervised machine learning (ML) algorithms. Results have shown that the method is able to distinguish device type with up to 100% precision using the random forest (RF) classifier, and classify individual devices with up to 95.7% precision. These results demonstrate the applicability of the proposed DFP method for device identification, in order to provide a more secure and robust network.</span>

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Device identification using optimized digital footprints

Chowdhury

Idris²,

Abas³

2023

IJ-AI

View full text Add to dashboard Cite

show abstract

“… The datasets will help researchers in optimizing and analyzing network communication used by IoT devices in an IoT network, e.g. device identification [1 , 2] , and device log prediction [3] are some of the techniques developed for IoT security by analyzing the network communication behaviour. The given IoT datasets can be analyzed by researchers in the context of network bandwidth and storage capability required for home or office automation since data were recorded in a separate file every day.…”

Section: Value Of the Datamentioning

confidence: 99%

Section: Value Of the Datamentioning

confidence: 99%

Packet-level and IEEE 802.11 MAC frame-level network traffic traces data of the D-Link IoT devices

Chowdhury

Aneja

et al. 2021

Data in Brief

Self Cite

View full text Add to dashboard Cite

With the growth of wireless network technology-based devices, identifying the communication behaviour of wireless connectivity enabled devices, e.g. Internet of Things (IoT) devices, is one of the vital aspects, in managing and securing IoT networks. Initially, devices use frames to connect to the access point on the local area network and then, use packets of typical communication protocols through the access point to communicate over the Internet. Toward this goal, network packet and IEEE 802.11 media access control (MAC) frame analysis may assist in managing IoT networks efficiently, and allow investigation of inclusive behaviour of IoT devices. This paper presents network traffic traces data of D-Link IoT devices from packet and frame levels. Data collection experiment has been conducted in the Network Systems and Signal Processing (NSSP) laboratory at Universiti Brunei Darussalam (UBD). All the required devices, such as IoT devices, workstation, smartphone, laptop, USB Ethernet adapter, and USB WiFi adapter, have been configured accordingly, to capture and store network traffic traces of the 14 IoT devices in the laboratory. These IoT devices were from the same manufacture (D-Link) with different types, such as camera, home-hub, door-window sensor, and smart-plug.

show abstract

“…Recently, device identification by learning from traffic features has become a hotspot of research. The related supervised ML algorithms [14] include Random Forest (RF) [15][16][17][18], K-Nearest Neighbors (KNN) [19], Support Vector Machine (SVM) [20][21][22], Gradient boosting [23], Naive Bayes [24,25], Decision Trees (DT) [26], NLP [27], and so on. The related unsupervised ML methods include the Gibbs Sampling Dirichlet Multinomial Mixture Model (GSDMM) [28], Density-Based Spatial Clustering of Applications with Noise (DBSCAN) [29], Kmeans [30], and so on.…”

Section: Introductionmentioning

confidence: 99%

WYSIWYG: IoT Device Identification Based on WebUI Login Pages

Wang¹,

Li²,

Jing³

et al. 2022

Sensors

View full text Add to dashboard Cite

With the improvement of intelligence and interconnection, Internet of Things (IoT) devices tend to become more vulnerable and exposed to many threats. Device identification is the foundation of many cybersecurity operations, such as asset management, vulnerability reaction, and situational awareness, which are important for enhancing the security of IoT devices. The more information sources and the more angles of view we have, the more precise identification results we obtain. This study proposes a novel and alternative method for IoT device identification, which introduces commonly available WebUI login pages with distinctive characteristics specific to vendors as the data source and uses an ensemble learning model based on a combination of Convolutional Neural Networks (CNN) and Deep Neural Networks (DNN) for device vendor identification and develops an Optical Character Recognition (OCR) based method for device type and model identification. The experimental results show that the ensemble learning model can achieve 99.1% accuracy and 99.5% F1-Score in the determination of whether a device is from a vendor that appeared in the training dataset, and if the answer is positive, 98% accuracy and 98.3% F1-Score in identifying which vendor it is from. The OCR-based method can identify fine-grained attributes of the device and achieve an accuracy of 99.46% in device model identification, which is higher than the results of the Shodan cyber search engine by a considerable margin of 11.39%.

show abstract

Network Traffic Analysis based IoT Device Identification

Cited by 22 publications

References 12 publications

Device identification using optimized digital footprints

Device identification using optimized digital footprints

Packet-level and IEEE 802.11 MAC frame-level network traffic traces data of the D-Link IoT devices

WYSIWYG: IoT Device Identification Based on WebUI Login Pages

Contact Info

Product

Resources

About