WiFinger: Fingerprinting Noisy IoT Event Traffic Using Packet-level Sequence Matching

TL;DR

WiFinger is a novel fingerprinting method that accurately identifies multiple IoT events in noisy Wi-Fi traffic by transforming traffic analysis into subsequence matching, outperforming existing techniques.

Contribution

It introduces a subsequence matching approach for IoT traffic fingerprinting that handles wireless noise and supports multi-event tracking with reduced training efforts.

Findings

Achieves 89% average recall in identifying IoT events.

Outperforms existing methods with significantly higher accuracy.

Maintains almost zero false positives.

Abstract

IoT environments such as smart homes are susceptible to privacy inference attacks, where attackers can analyze patterns of encrypted network traffic to infer the state of devices and even the activities of people. While most existing attacks exploit ML techniques for discovering such traffic patterns, they underperform on wireless traffic, especially Wi-Fi, due to its heavy noisiness and the packet loss of wireless sniffing. In addition, these approaches commonly target distinguishing chunked IoT event traffic samples, and they fail at effectively tracking multiple events simultaneously. In this work, we propose WiFinger, a fine-grained multi-IoT event fingerprinting approach against noisy traffic. WiFinger turns the traffic pattern classification task into a subsequence matching problem and introduces novel techniques to account for the high time complexity while maintaining high accuracy. In addition, its reliance on training sample volumes reduces efforts for any future fingerprint updates. Experiments demonstrate that WiFinger outperforms existing approaches under practical threat models, with an average recall of 89% (v.s. 49% and 46% respectively) and almost zero false positives for various IoT events.