Protocol-agnostic IoT Device Classification on Encrypted Traffic Using Link-Level Flows

Convenience is a strong driver for the evolution of technology. Such efforts have given rise to the Internet-of-Things (IoT), defined as the network of everyday devices (i.e., “things”) ranging from light bulbs to smart speakers, connected to the Internet and each other. IoT devices frequently transmit data wirelessly which can be passively collected by an adversary. In this work we present a methodology with which to perform device classification on encrypted traffic in a protocol-agnostic manner by applying network flow analysis to link-level data. Our evaluation demonstrates successful device classification for 15 device categories with an overall weighted F1-Score of 95% on a dataset consisting of Wi-Fi, Bluetooth, and Zigbee traffic. Furthermore, we explore model transferability between encrypted and decrypted datasets on these three networking protocols and present our flow generation tool, ProtoFlow.