Protocol-agnostic IoT Device Classification on Encrypted Traffic Using Link-Level Flows

Date
2023-05-09
Authors
Morales, Gabriel A.
Bienek-Parrish, Adam
Jenkins, Patrick
Slavin, Rocky
Journal Title
Journal ISSN
Volume Title
Publisher
Association for Computing Machinery
Abstract

Convenience is a strong driver for the evolution of technology. Such efforts have given rise to the Internet-of-Things (IoT), defined as the network of everyday devices (i.e., “things”) ranging from light bulbs to smart speakers, connected to the Internet and each other. IoT devices frequently transmit data wirelessly which can be passively collected by an adversary. In this work we present a methodology with which to perform device classification on encrypted traffic in a protocol-agnostic manner by applying network flow analysis to link-level data. Our evaluation demonstrates successful device classification for 15 device categories with an overall weighted F1-Score of 95% on a dataset consisting of Wi-Fi, Bluetooth, and Zigbee traffic. Furthermore, we explore model transferability between encrypted and decrypted datasets on these three networking protocols and present our flow generation tool, ProtoFlow.

Description
Keywords
Internet-of-Things, IoT, traffic flow, network analysis, networking standards, classification
Citation
Morales, G. A., Bienek-Parrish, A., Jenkins, P., & Slavin, R. (2023). Protocol-agnostic IoT Device Classification on Encrypted Traffic Using Link-Level Flows. Paper presented at Cyber-Physical Systems and Internet of Things Week 2023, San Antonio, TX, USA. https://doi.org/10.1145/3576914.3587487
Department
Computer Science