[Paper Review] IoTSense: Behavioral Fingerprinting of IoT Devices

Bruhadeshwar Bezawada, Maalvika Bachani+4 more|arXiv (Cornell University)|Apr 11, 2018

Internet Traffic Analysis and Secure E-voting8 references72 citations

TL;DR

This paper proposes IoT behavioral fingerprinting using network traffic features and machine learning to identify device types, categories, and instances, achieving high accuracy even with encrypted traffic.

ABSTRACT

The Internet-of-Things (IoT) has brought in new challenges in, device identification --what the device is, and, authentication --is the device the one it claims to be. Traditionally, the authentication problem is solved by means of a cryptographic protocol. However, the computational complexity of cryptographic protocols and/or scalability problems related to key management, render almost all cryptography based authentication protocols impractical for IoT. The problem of device identification is, on the other hand, sadly neglected. We believe that device fingerprinting can be used to solve both these problems effectively. In this work, we present a methodology to perform device behavioral fingerprinting that can be employed to undertake device type identification. A device behavior is approximated using features extracted from the network traffic of the device. These features are used to train a machine learning model that can be used to detect similar device types. We validate our approach using five-fold cross validation; we report a identification rate of 86-99% and a mean accuracy of 99%, across all our experiments. Our approach is successful even when a device uses encrypted communication. Furthermore, we show preliminary results for fingerprinting device categories, i.e., identifying different device types having similar functionality.

Motivation & Objective

• Motivate secure identification and authentication of IoT devices through behavioral fingerprinting.
• Model IoT device behavior as a collection of protocol interactions and command-response sessions.
• Extract robust network-based features to build a behavioral profile for device type identification.
• Evaluate the approach across multiple device types and categories to demonstrate robustness and practicality.

Proposed method

• Capture device network traffic and extract features from packet headers and payloads.
• Represent device behavior as sequences of protocol interactions (sessions) and extract features per five-packet fingerprint.
• Use 20 features per fingerprint (17 header features + 3 payload features) to train a classifier.
• Employ gradient boosting as the primary classifier and evaluate with five-fold cross-validation.
• Test both full feature sets and reduced sets (e.g., without entropy) to assess performance under encrypted-like conditions.

Experimental results

Research questions

• RQ1 Can IoT device types be accurately identified from short network fingerprints derived from observed sessions?
• RQ2 Do payload-based features (entropy, payload length, TCP window size) plus header features provide robust fingerprints even when payloads are encrypted?
• RQ3 Can the approach scale to identify device categories and individual instances with high accuracy?

Key findings

• Device-type identification rates range from 93% to 99% with mean accuracy around 99%.
• Removing entropy (to simulate encrypted traffic) yields only 1-2% drop in performance, maintaining near-identical results.
• Device category identification rates span 91% to 99%, with mean category accuracy 97%+ across experiments.
• Device-instance fingerprinting achieves 99.7%–100% recognition across tested instances.
• A five-packet fingerprint (5 consecutive packets) with 100 features (20 features per packet) suffices for robust identification.
• Features like TCP window size, entropy, and payload length are statistically significant for fingerprinting.