Automated IoT Device Identification using Network Traffic
Ahmet Aksoy, Mehmet Hadi Güneş · 2019
IoT devices have been gaining popularity and become integral to our daily life. These devices are prone to be compromised as well as any computing system, but lack computing capabilities for cybersecurity software. An important measure for protecting attacks on IoT devices is through isolation of such devices by restriction of communications to the device from firewall/gateway. To this end identification of the IoT device is valuable for network administration and security. In this paper, we introduce a system for automated classification of device characteristics, called System IDentifier (SysID), based on their network traffic. SysID uses any single packet that is originated from the device to detect its kind. We use genetic algorithm (GA) to determine relevant features in different protocol headers and then deploy various machine learning (ML) algorithms (i.e., DecisionTable, J48 Decision Trees, OneR, and PART) to classify host device types by analyzing features selected by GA. GA helps reduce classification complexity and increases its accuracy by eliminating noisy features from the data. SysID allows the ability to have a completely automated way of classifying IoT devices using their TCP/IP packets without expert input for classification. In an experimental study with 23 IoT devices, SysID identified the device type from a single packet with over 95% accuracy.