[Paper Review] IoT Inspector: Crowdsourcing Labeled Network Traffic from Smart Home Devices at Scale

Danny Yuxing Huang, Noah Apthorpe+3 more|arXiv (Cornell University)|Sep 21, 2019

Internet Traffic Analysis and Secure E-voting29 references50 citations

TL;DR

The paper introduces IoT Inspector, an open-source software tool to crowdsource large-scale labeled smart home network traffic from real homes, enabling data-driven research while preserving user privacy.

ABSTRACT

The proliferation of smart home devices has created new opportunities for empirical research in ubiquitous computing, ranging from security and privacy to personal health. Yet, data from smart home deployments are hard to come by, and existing empirical studies of smart home devices typically involve only a small number of devices in lab settings. To contribute to data-driven smart home research, we crowdsource the largest known dataset of labeled network traffic from smart home devices from within real-world home networks. To do so, we developed and released IoT Inspector, an open-source tool that allows users to observe the traffic from smart home devices on their own home networks. Since April 2019, 4,322 users have installed IoT Inspector, allowing us to collect labeled network traffic from 44,956 smart home devices across 13 categories and 53 vendors. We demonstrate how this data enables new research into smart homes through two case studies focused on security and privacy. First, we find that many device vendors use outdated TLS versions and advertise weak ciphers. Second, we discover about 350 distinct third-party advertiser and tracking domains on smart TVs. We also highlight other research areas, such as network management and healthcare, that can take advantage of IoT Inspector's dataset. To facilitate future reproducible research in smart homes, we will release the IoT Inspector data to the public.

Motivation & Objective

• Crowdsource a large-scale labeled dataset of smart home network traffic from real-world homes.
• Provide an easy-to-use, privacy-conscious tool that encourages broad participation.
• Standardize and validate device labels to enable reliable cross-device research.
• Demonstrate the dataset’s value through security/privacy case studies and encourage reproducible research.

Proposed method

• Develop a software-based data collection tool that users install on macOS/Linux and run with minimal setup.
• Use ARP scanning to discover devices and ARP spoofing to intercept traffic from chosen devices without dedicated hardware.
• Collect network traffic data (e.g., TLS Client Hello, DNS requests, hostnames, etc.) and user-provided device labels.
• Anonymize and securely upload data with user-consent and privacy-preserving practices.
• Preprocess data into flows and generate human-readable endpoint labels to help users understand their traffic.
• Standardize and validate device labels using multiple external information sources to improve label consistency.

Experimental results

Research questions

• RQ1 Can crowdsourced, labeled network traffic from real homes scale to tens of thousands of devices across many vendors?
• RQ2 What security and privacy insights can be derived from large-scale, labeled IoT traffic in-the-wild (e.g., TLS usage, third-party advertisers)?
• RQ3 How reliable are user-provided device labels when cross-validated with external sources, and how can labeling be standardized for research use?
• RQ4 What is the impact of providing real-time user insights on engagement and data collection quality?

Key findings

• The dataset includes traffic from 4,322 users and 44,956 devices, with 12,690 devices user-labeled.
• 25% of users collected at least 2.8 hours of traffic; 10% collected at least 12.4 hours.
• 1,501 users manually labeled 8,131 devices across 53 manufacturers.
• 46 of 53 observed vendors use TLS, but several vendors use outdated TLS versions or insecure ciphers.
• 350 distinct third-party advertiser/tracking domains were identified on 19 observed smart TV vendors.
• The dataset enables analyses across security/privacy, network management, and health-related research areas.