Morales, Gabriel A.Bienek-Parrish, AdamJenkins, PatrickSlavin, Rocky2023-11-272023-11-272023-05-09Morales, G. A., Bienek-Parrish, A., Jenkins, P., & Slavin, R. (2023). Protocol-agnostic IoT Device Classification on Encrypted Traffic Using Link-Level Flows. Paper presented at Cyber-Physical Systems and Internet of Things Week 2023, San Antonio, TX, USA. https://doi.org/10.1145/3576914.3587487979-8-4007-0049-1https://doi.org/10.1145/3576914.3587487https://hdl.handle.net/20.500.12588/2243Convenience is a strong driver for the evolution of technology. Such efforts have given rise to the Internet-of-Things (IoT), defined as the network of everyday devices (i.e., “things”) ranging from light bulbs to smart speakers, connected to the Internet and each other. IoT devices frequently transmit data wirelessly which can be passively collected by an adversary. In this work we present a methodology with which to perform device classification on encrypted traffic in a protocol-agnostic manner by applying network flow analysis to link-level data. Our evaluation demonstrates successful device classification for 15 device categories with an overall weighted F1-Score of 95% on a dataset consisting of Wi-Fi, Bluetooth, and Zigbee traffic. Furthermore, we explore model transferability between encrypted and decrypted datasets on these three networking protocols and present our flow generation tool, ProtoFlow.en-USAttribution-NonCommercial-ShareAlike 3.0 United Stateshttp://creativecommons.org/licenses/by-nc-sa/3.0/us/Internet-of-ThingsIoTtraffic flownetwork analysisnetworking standardsclassificationArticle