Network Traffic Analysis based IoT Device Identification

Device identification is the process of identifying a device on Internet without using its network identifiers or other credentials such as IP address, Medium Access Control (MAC) address, Electronic Serial Number (ESN), International Mobile Station Equipment Identity (IMEI) number or Mobile Identification Number (MIN). These identifiers can be altered or manipulated by using expert knowledge of networking or software, which can create significant security threats where devices identification play key security roles. DFP exploits device-specific signature or packet information (feature set) which the device uses for communication over the network (Aneja et al., 2018). Effective device fingerprint must assure two attributes (i) the features are hard to forge, (ii) the DFP remains stable even when devices move from one network to another network (Xu et al., 2015). DFP has emerged as a significant solution for device identification (or authentication) due to its resistance against vulnerabilities such as node forgery or masquerading in IoT network. Features used for DFP are classified based on their extraction methods. There are two techniques namely active and passive which have been observed to impact the identification of devices. In active fingerprinting, devices are probed with different types of packets and the subsequent received responses are analyzed to attain unique fingerprints. In contrast, in passive fingerprinting, a profiler observes ongoing communication of the target system without any obvious querying into the system, by analyzing and extracting information from transmitted packets. In this paper, we used passively observed datasets to evaluate the proposed method, our DFP approach is for passive fingerprinting.

A DFP approach proposed based on the analysis of (each packet) 23 features from 12 network packets by Miettinen et al. (Miettinen et al., 2017). The set of features were represented as binary (0 or 1) and integer values, where binary value 1 define the protocol used during communication. Overall, the scheme achieved identification accuracy of 81.50% (global ratio) over the 27 devices using the IoT Sentinel dataset (Miettinen et al., 2017).

The single packet-based DFP method (Aksoy and Gunes, 2019) uses genetic algorithm (GA) to determine the feature subset which contributes substantially, for generation of device fingerprint used for device identification. This approach has been shown to achieve approximate classification accuracy of over 95% for device genre and 82% for individual device type using 23 IoT devices from IoT Sentinel dataset (Miettinen et al., 2017).

We worked on a device fingerprinting approach using packets header information (distinct protocols header features) from the target devices to extract a unique set of features (actual feature values) to generate device fingerprint. Features are assessed using three metrics: the variability of a feature, the stability of a feature, and the suitability of a feature, to learn the most suitable feature subset. Metrics evaluation results assign a score to each of the features to form a feature vector. The feature set is subsequently processed to filter feature subset according to the user-defined threshold value $\lambda$ whereas a lambda value ranged between 0 and less than 1. Finally, we used machine learning (ML) classification algorithms to classify individual IoT device type or genre by using selected feature subset vectors of each device. While two algorithms, such as J48 and PART, outperformed compare to other classification algorithms. However, based on the user expected accuracy $\lambda$ value can be changed empirically. To evaluate our proposed DFP method we used two publicly available datasets: IoT Sentinel dataset (Miettinen et al., 2017) and UNSW dataset (Sivanathan et al., 2018). While we achieved approximate classification accuracy to 99.37% for device genre and 83.35% for individual device type by using IoT Sentinel dataset (Miettinen et al., 2017) and 97.78% of precision achieved using 10678 instances from UNSW dataset (Sivanathan et al., 2018) for identification of individual device type. The contributions of this paper are the following:

• •

  We present a conceptual IoT network model incorporating device identification with a wide range of IoT devices (Section 2).

• •

  We introduce metric-entropy based packet header features assessment methodology using three metrics for device fingerprinting and design of our proposed DFP approach (Section 5).

• •

  We examine proposed DFP method using two datasets, which consists of various real-world IoT devices (Section 6).

The rest of this paper is organized as follows: Section 2 describes a conceptual IoT network model to depict the DFP incorporated in the IoT network. In Section 3, notations and device information are presented, and preliminary of the metrics evaluation process is discussed in Section 4. The proposed DFP approach is illustrated in Section 5, while experimental results with the different datasets are discussed in Section 6. Section 7 addresses related work and Section 8 presents the conclusion and the future direction of work.

We presume that our network model comprises of various types of IoT devices, which are used in smart homes, smart buildings or enterprises (Shahid and Aneja, 2017). In a network, most of the devices, such as IP cameras (TP-LinkCam, EdimaxCam), smart bulbs, connect to the user’s network (a single access point gateway) directly either through WiFi (wireless fidelity) or Ethernet connection to access the Internet services.

Most of the devices are identified by using explicit identifiers, such as IP address, MAC address and other network identities. Devices use these identifiers to communicate on the network. Unfortunately, all these identifiers have been exhibited to be easily mutable by using software (Douceur, 2002). Spoofing is one of the techniques which can forge a device explicit identifier to gain illegitimate access to restricted resources in the network. For example, an ioctl system call can be used to forge or modify MAC address of a device network interface card (NIC) (Xu et al., 2015) to access a network (e.g. a corporate office) where devices are recognized by using their MAC addresses. Similarly, IoT Node using spoofed IP address can launch crucial attacks while communicating with an access point (AP) to get required services. Initially, each device on the IoT network is identified by using their unique IPv4 address, however, even IP address is spoofed than also it would be unique. Moreover the range of spoofed IP address is restricted by type of the network e.g. 256 in case of Type C network.

IoT devices are classified as resource-constrain devices (et al., 2018) in terms of processing power, communication capability, memory and energy, while complex cryptography algorithms can be used to secure the device identity. Therefore, while communicating the encrypted data, the processing power of devices must be preserved. In other words, a secure method is required to identify devices without using the traditional identifiers, such as IP address or MAC address. An intuition that network traffic provides device-specific signature since devices comprised different types of hardware-software and used distinct communication protocols in a network. DFP is a technique to identify IoT devices using network traffic information from the target devices. Conceptual network model is shown in Figure 1 wherein the proposed DFP method can be used to generate unique identifiers of IoT devices to overcome the spoofed network identities of the device.

We assume that our proposed DFP scheme is able to capture all types of network traffic (inbound and outbound traffic) passively on the access point (AP). The IoT Node communicate for various services e.g. DNS to translate domain name of Internet resources, SSL/TLS certificates to encrypt and decrypt data, NTP server to synchronize device time, and Manufacture server to upgrade firmware services. This communication of IoT Node is captured on the AP shown in Figure 1. In the proposed model packets payload information are not considered, which can be plain text, compressed, binary or encrypted data. We only focused on packet header features (or fields) (Bezawada et al., 2018), (Miettinen et al., 2017), (Aksoy and Gunes, 2019). An intuition that distinct protocols features from the packet header provide a significant fingerprint for device identification. This fingerprint is generated using header information of all the packets and regularly updated on the device identifier station. Device identifier evaluates the feature set from n number of packets from each device to determine the most suitable subset of features and then train a model for devices classification using an ML classification algorithm. Finally, the AP uses this classification model to authenticate devices in the IoT network.

A list of notations used to describe our proposed DFP approach are listed in Table 1 along with a description of each notation.

We utilized publicly available two datasets to evaluate our proposed DFP method. The datasets are IoT Sentinel (Miettinen et al., 2017) dataset and UNSW (Sivanathan et al., 2018) dataset containing different types of IoT devices. We use a total of 27 IoT devices from IoT Sentinel dataset. There are a total 12 genres or groups of devices in IoT Sentinel (Miettinen et al., 2017): Aria, D-Link (D-LinkCam, D-LinkDayCam, D-LinkDoorSensor, D-LinkHomeHub, D-LinkSensor, D-LinkSiren, D-LinkSwitch and D-LinkWaterSensor), Hue (HueSwitch and HueBridge), Smarter (iKettle2 and SmarterCoffee), Lightify, MAXGateway, TP-Link (TP-LinkPlugHS100 and TP-LinkPlugHS110), WeMo (WeMoInsightSwitch, WeMoLink and WeMoSwitch) and Withings. We use a total of 19 devices from UNSW dataset. All these devices information are listed in Table 2 and Table 3.

[Note: $\star$ indicates devices are from the same manufacturer as above]

Robyns et al. (Robyns et al., 2017) defined three metrics: (a) the variability of a bit (b) the stability of a bit and (c) the suitability of a bit for bitwise entropy evaluation of a Probe-Request frame on a WiFi network.

The defined metric variability attains ideal value $1$ when the feature (particular field of packet format) over the multiple transmission from the devices is highly variable over all the devices and therefore uniquely contribute to fingerprint of the device e.g IP address of a device is unique and therefore contribute highly to the feature set for fingerprinting the device.

Similarly, the defined metric stability attains ideal value $1$ when the feature among other features of the device uniquely identify the device and remains stable over the multiple transmissions from the device. The defined metric suitability uses variability, and stability by multiplying to calculate the feature suitability. Robyns et al. evaluated suitability of features e.g. SSID, vendor specific data, HT capabilities in a frame to identify the mobile devices. The authors included the MAC address while evaluating frame for the metrics.

We define the metrics at character-level for packet header analysis on 212 set of features and improve the IoT Sentinel dataset classification compared to (Aksoy and Gunes, 2019) without IP address and the method outperformed with IP address. The character-level metric is more promising, as the bit-wise metric evaluate the probability density of frame vector over $\{0,1,none\}$ while character level metric evaluate the probability density value of feature vector over$\{0,1,\ldots,9,none\}$. The bit wise evaluation (Robyns et al., 2017) drops the accuracy gradually e.g the reported accuracy of 10-100 devices including MAC Address is 60-87%.

In this section, we describe major components of our device fingerprinting method to identify IoT device type or genre based on a single TCP/IP packet. This method appraises Network layer (IP and ICMP), Transport layer (TCP and UDP) and Application layer (DNS, HTTP, TLS/SSL and DHCP) protocols header fields (or features) to learn the most suitable subset of features among a large number of features, which can be used for device fingerprinting. We define three character-level metrics, variability of a feature, stability of a feature, and suitability of a feature to assess the feature set. This process identifies a suitable subset of features which are unique to each device, while a lambda value is utilized to filter selected feature subset according to the expected accuracy. Then we perform a machine learning classification algorithm to identify or classify individual IoT device type or genre by using a selected subset of features. The entire process of our proposed DFP scheme is illustrated in Figure 2.

In this section, we describe our experimental process and results based on the two datasets. First, we extracted all the devices originated network packets or instances from the individual device (.pcap files) by using T-shark (Gerald, 1998), with each device identified based on their MAC address or IP address. Then, all the device instances were filtered according to the selected protocols used for our DFP approach and were also labeled according to the individual device type and genre.

All the devices information (46 IoT devices) from both datasets are listed in Table 2 and Table 3, on which our proposed DFP approach was carried out. In our experiment to evaluate the features, we used approximately 100 packets from each device to compute the three metrics explained in Section 5.

However, from our observation, we noticed that in most of the cases, the total number of distinct values of a feature varies from 0 to 100, as shown in Figure 3 e.g. IP address has one distinct value for each device. Hence, we do not consider a feature with a large number of distinct values in our metrics computation separately. We assume that these types of features always provide a prominent result for DFP.

The process of gathering device-specific signature from the analysis of network traffic to form a device fingerprint and using them by various classification algorithms to identify individual device type or genre provide significant solutions to distinct research issues. In our study, we mainly focus on network traffic (or packets) analysis based DFP approaches and publicly available commonly used two datasets namely IoT Sentinel (Miettinen et al., 2017) dataset and UNSW (Sivanathan et al., 2018) dataset, which consists of different types of IoT devices.

A DFP approach proposed based on the analysis of 12 consecutive network packets from a target device by Miettinen et al. (Miettinen et al., 2017). The authors extracted 23 features from a packet header includes Link layer (ARP, LLC), Network layer (IP, ICMP, ICMPv6, EAPoL), Transport layer (TCP, UDP) and Application layer (HTTP, HTTPS, DHCP, BOOTP, SSDP, DNS, MDNS, NTP) protocols, IP options, Packet content, IP address and Port class to form (12 $\ast$ 23) = 276-dimensional feature vector for a device fingerprint. The set of features represented as binary (0 or 1) and integer values, whereas binary values 1 define some protocols are used during communication. However, from each device, a set of fingerprints are utilized to train a model using Random Forest classification algorithm to perform device identification. The scheme generates one classifier per device type. While a new device type fingerprints captured by the scheme, it is required to train a new classifier to avoid any modification of the existing classifiers. Overall, the scheme achieved identification accuracy of 81.50% (global ratio) over the 27 devices from IoT Sentinel dataset (Miettinen et al., 2017). In comparison, our scheme uses less number of protocol header information from a single packet to construct a device fingerprint and we are able to classify devices (type or genre) by using a single classifier.

Bezawada et al. (Bezawada et al., 2018) presented a device identification mechanism based on the analysis of devices behavioral fingerprint. The researchers extracted 20 features from a packet, which includes distinct protocols from the Link layer, Network layer, Transport layer and Application layer, IP options, entropy of payload, TCP payload length and TCP windows size. While the 17 features are utilized as binary values of 0 or 1 to represent the absence or presence of a particular feature and the 3 other features use as numerical values. The authors grouped device originated 5 packets (as a session) to form a feature vector of (5 $\ast$ 20) = 100 features for a device fingerprinting. Finally, these feature vectors are used to train a machine learning classification algorithm to predict the device type. From the test-bed of 10 unique devices, the scheme achieved a true positive rate of 99.0% to 100.0% using all the selected features. Though, the identification accuracy decreased on average 2% without using payload entropy. In contrast, we use only the packet header information to preserve the privacy of users’ data and generate a feature vector from a single TCP/IP packet.

Ammar et al. (Ammar et al., 2019) described a DFP approach based on the analysis of service discovery protocols (mDNS and SSDP), DHCP and HTTP protocols on IoT Sentinel (Miettinen et al., 2017) dataset and their own dataset. The authors extracted features as textual information from the first few sets of device originated packets. This textual information from each device modelled as a binary data by using the Bag of Words (BOW) technique for device identification. The scheme first extracts a list of unique words from all devices and then each device information turn into a feature vector, whereas a binary value set to 1 if the word present in the device information and set to 0 if not. Then all the devices information are used to form a matrix while each column defines a unique word and each row represents a device. For classification, devices are evaluated using a similarity verification process. The scheme identified 31 devices among 33 of the unique test devices. However, in some cases, accuracy can be decreased when IoT devices may not use any discovery protocol. Comparing to this scheme, our method uses packet header features of protocols in Table 4 to train a model using ML classification algorithm for device identification.

Guo et al. (Guo and Heidemann, 2018) discussed a device identification approach using network traffic analysis and knowledge of devices manufacturer server names. The scheme tracked a list of server names each device communicate regularly and then defined a threshold number of server names require for device identification. Server names are filtered to exclude third-party and human-facing servers to improve accuracy. The authors examined the presence of server names in network traffic from a given IP address to identify what types of IoT devices present in the network.

From a controlled experiment on 10 IoT devices and 15 non-IoT devices, the reported accuracy of the scheme was 96%. Our method has some significant differences. We use only packet header features to identify devices without tracking any server names along with IP address. Our scheme can be used to identify IoT devices in a network where manufacturer of the devices are different. When the manufacturer is same in our scheme e.g. 8 D-Link devices the individual device identification is not sufficiently competent 85.35% without IP address and 99.77% with IP address.

Aksoy et al. (Aksoy and Gunes, 2019) proposed a DFP method to identify an IoT device (type or genre) using any single TCP/IP packet content from the device.

The scheme analyzed the Network layer (IP, ICMP), Transport layer (TCP, UDP) and Application layer (DNS, HTTP and SSL) protocols header information to extract 212 features from each packet. Then applied a genetic algorithm (GA) to select feature subsets to create device fingerprint. These selected feature subsets used to train various ML classification algorithms to identify devices. The scheme utilizes two-level of classification to improve accuracy. Whereas first determine the manufacture of devices and then identify individual device type from the same manufacturer using different classifiers. The experiment on IoT Sentinel (Miettinen et al., 2017) dataset over the 23 IoT devices the average classification accuracy was 82% for the cumulative of all the devices and over 95% of precision for device genre classification. However, the scheme was not able to achieve a higher rate of accuracy since some devices had similar network behaviors from the same manufacturer. The main difference between our scheme and SysID is feature subset evaluation process. We use character-level analysis of each feature based on the three metrics, while SysID uses a GA to select feature subsets to generate device fingerprinting.

Sivanathan et al. (Sivanathan et al., 2018) described a framework for IoT devices classification approach by using statistical analysis of network traffic characteristics. The authors extracted network traffic passively to compute traffic characteristics. To characterize network traffic from a device, the authors converted all the raw pcap files into flows using the Joy tool on an hourly basis and then calculated statistical attributes of traffic activity patterns (flow volume, flow duration, average flow rate and device sleep time) and signalling patterns (server port numbers, DNS queries, NTP queries and Cipher suite). This framework consists of two stages, in Stage-0 each multi-valued attributes are fed into corresponding Naive Bayes classifiers in the form of BoW to generate two outputs - a tentative class and a confidence level and outputs are provided into the next stage. In Stage-1, all the quantitative attributes from traffic flow and outputs of Stage-0 use to train a classifier based on the Random Forest algorithm to perform device identification. The accuracy of the experiment was above 99% for a set of 28 IoT devices. However, the scheme requires a large number of packets from a network flow for statistical analysis.

In contrast, our scheme uses a single TCP/IP packet header information for classification of devices, while features are evaluated using the three metrics.

Robyns et al. (Robyns et al., 2017) presented mobile devices fingerprinting scheme based on a single Probe-Request frame. The scheme used per bit entropy analysis of the frames from different devices using the three metrics evaluation process to construct device fingerprint (bit patterns), while frames captured by monitoring stations (MSs) without concern of device users. This non-cooperative MAC layer fingerprinting method uses to track mobile devices location. The accuracy of the scheme achieved between 80.0% to 67.6% for a small dataset of 50 to 100 devices, while for a large dataset of 1000 to 10000 devices the accuracy varied from 33.0% to 15.1%. The scheme provides a mechanism to defeat MAC address randomization problem conjunction with some temporal information. In comparison, our method uses in a home network to capture network packets on an AP and features are extracted from each packet header information to construct suitable feature subset for device fingerprinting. In our DFP scheme, features are evaluated on character-level using the three metrics to identify the most suitable feature subset.

In this paper, we presented a DFP approach using device originated network traffic (or packets) and machine learning classification algorithms to identify individual device type or genre based on a single packet header features. We learned the most suitable feature subset automatically by utilizing three metrics assessment process of the features. This process assigned a score to every feature according to their significance for device identification, whereas a user-defined threshold value helped to remove noisy features and improve classification accuracy. Overall, the proposed DFP scheme achieved 99.37% of precision to identify each device genre and 83.35% of accuracy to classify individual device type from IoT Sentinel dataset. However, for some devices, the proposed method was not able to achieve a higher rate of accuracy since some devices have similar network behaviors from the same manufacturer. On the other hand, the scheme reached a mean accuracy of 97.78% using UNSW dataset, where most of the devices were from the different manufacturers.

In future, we will investigate other packet header features logged from the network protocols during communication to identify unique feature subset to improve accuracy of the same manufacturer e.g. D-Link 20 devices. Moreover, the problem will be more intense when finding feature for the same device from the same manufacturer e.g. 20 D-Link Cam.