RAFM: A Real-time Auto Detecting and Fingerprinting Method for IoT devices

Abstract

In recent years, with the rapid development of Internet of Things (IoT) technology, a large number of Internet of things devices such as network printers, webcams and routers have emerged in the cyberspace. However, the situation of network security is increasingly serious. Large-scale network attacks launched by terminal devices connected to the Internet occur frequently, causing a series of adverse effects such as information leakage and property loss to people. The establishment of a set of fingerprint generation system for Internet of things devices to accurately identify the device type is of great significance for the unified security control of the Internet of things. We proposed a RAFM which is a detection and identification system of IoT. RAFM consists two major module including auto detection and fingerprinting. RAFM collects messages sent by different Internet of things devices by means of passive listening. Based on the differences in the header fields of different devices, it USES a series of multi-class classification algorithms to identify device types. Simulation experiments show that RAFM can achieve an average prediction accuracy of 93.75%.

Early Generation and Detection of Efficient IoT Device Fingerprints Using Machine Learning

“…Cheng et al [23] have proposed a real-time method for IoT devices' auto-detection and classification system. This approach is accomplished by using passive listening to collect messages received from various IoT devices, then using a multi-classification recognition method to identify these devices based on the differences in the header fields of various devices.…”

High-accuracy model recognition method of mobile device based on weighted feature similarity

“…from the network layer data and application layer data in traffic, and use a variety of machine learning algorithms to build a phased recognition classifier to identify device. Cheng et al 22 recognize the device according to the difference between the file headers of devices in active measurement traffic. To improve the security in training model, He et al 23 build a recognition model based on federal learning.…”