IoTDevID: A Behavior-Based Device Identification Method for the IoT

TL;DR

IoTDevID is a machine learning method that accurately identifies IoT devices based on network packet characteristics, including non-IP and low-energy protocols, demonstrating high generalizability and improved feature predictive power.

Contribution

The paper introduces IoTDevID, a novel device identification approach that uses rigorous feature analysis to outperform existing methods and generalize across unseen data.

Findings

High predictive accuracy on public datasets

More predictive feature set than existing methods

Effective detection of non-IP and low-energy protocol devices

Abstract

Device identification is one way to secure a network of IoT devices, whereby devices identified as suspicious can subsequently be isolated from a network. In this study, we present a machine learning-based method, IoTDevID, that recognizes devices through characteristics of their network packets. As a result of using a rigorous feature analysis and selection process, our study offers a generalizable and realistic approach to modelling device behavior, achieving high predictive accuracy across two public datasets. The model's underlying feature set is shown to be more predictive than existing feature sets used for device identification, and is shown to generalize to data unseen during the feature selection process. Unlike most existing approaches to IoT device identification, IoTDevID is able to detect devices using non-IP and low-energy protocols.