IoTSense: Behavioral Fingerprinting of IoT Devices

TL;DR

This paper presents IoTSense, a machine learning-based behavioral fingerprinting method for IoT device identification and authentication, achieving high accuracy even with encrypted traffic and enabling device category detection.

Contribution

The paper introduces a novel behavioral fingerprinting approach for IoT devices that does not rely on cryptography, addressing scalability and complexity issues in device authentication.

Findings

Identification rate of 86-99% across experiments

Mean accuracy of 99% in device identification

Effective even with encrypted communication

Abstract

The Internet-of-Things (IoT) has brought in new challenges in, device identification --what the device is, and, authentication --is the device the one it claims to be. Traditionally, the authentication problem is solved by means of a cryptographic protocol. However, the computational complexity of cryptographic protocols and/or scalability problems related to key management, render almost all cryptography based authentication protocols impractical for IoT. The problem of device identification is, on the other hand, sadly neglected. We believe that device fingerprinting can be used to solve both these problems effectively. In this work, we present a methodology to perform device behavioral fingerprinting that can be employed to undertake device type identification. A device behavior is approximated using features extracted from the network traffic of the device. These features are used to train a machine learning model that can be used to detect similar device types. We validate our approach using five-fold cross validation; we report a identification rate of 86-99% and a mean accuracy of 99%, across all our experiments. Our approach is successful even when a device uses encrypted communication. Furthermore, we show preliminary results for fingerprinting device categories, i.e., identifying different device types having similar functionality.