Automatic Device Classification from Network Traffic Streams of Internet of Things

TL;DR

This paper presents an LSTM-CNN based method for automatic classification of IoT devices from network traffic, enabling better device management and security in large-scale IoT deployments.

Contribution

It introduces a novel approach combining feature extraction and deep learning to identify unseen IoT devices from network traffic data.

Findings

High accuracy in device classification on real-world data

Effective identification of new and unseen devices

Insights into traffic features for device differentiation

Abstract

With the widespread adoption of Internet of Things (IoT), billions of everyday objects are being connected to the Internet. Effective management of these devices to support reliable, secure and high quality applications becomes challenging due to the scale. As one of the key cornerstones of IoT device management, automatic cross-device classification aims to identify the semantic type of a device by analyzing its network traffic. It has the potential to underpin a broad range of novel features such as enhanced security (by imposing the appropriate rules for constraining the communications of certain types of devices) or context-awareness (by the utilization and interoperability of IoT devices and their high-level semantics) of IoT applications. We propose an automatic IoT device classification method to identify new and unseen devices. The method uses the rich information carried by the traffic flows of IoT networks to characterize the attributes of various devices. We first specify a set of discriminating features from raw network traffic flows, and then propose a LSTM-CNN cascade model to automatically identify the semantic type of a device. Our experimental results using a real-world IoT dataset demonstrate that our proposed method is capable of delivering satisfactory performance. We also present interesting insights and discuss the potential extensions and applications.