Statistical Flow Classification for the IoT

Packet Length Spectral Analysis for IoT Flow Classification Using Ensemble Learning

“…The classification accuracy and performance in terms of precision, recall and the other metrics that we obtain is in line with the results obtained in our previous work [12], however we here use a very different set of features. More specifically, we focus on simplified features based on the length of the packets (in some cases complemented by the inter-arrival times) and further evaluate the performance on a much larger dataset.…”

“…The reason we do this is that we have found experimentally that the packets going from the client to the server provide a higher distinguishing power than the reverse direction. This is because, as noted earlier, for IoT devices the uplink traffic is much higher than the downlink traffic [12], [19], and further carries more information. In practice, in many cases the server simply acknowledges the reception of a packet, without any additional data, making the recognition hard as this behavior is invariant across different devices.…”

“…In our previous work, we have explored the use of several of these discriminators, including round-trip time and fractions of uplink vs. downlink volume, through a decision tree classifier [12]. In this paper, we adopt a different classifica-tion strategy that makes use of an ensemble of decision trees (a random forest) to reduce the overfitting problem.…”

“…To construct a classification procedure we use a supervised machine learning algorithm that can estimate the parameters for recognition from available labeled data. In previous work, we considered both clustering and decision trees [12] using features related to the fraction of upload versus download data. Clustering, however, did not produce sufficiently distinct classes when applied to real traffic, leading to confusion, while the decision tree has difficulty with generalization and suffers from overfitting.…”