Machine learning based network traffic classification approach for Internet of Things devices
Volodymyr Melnyk, Pavlo Haleta, N. Golphamid · Theoretical and Applied Cybersecurity · 2020
Due to design flaws, problems with implementations and improper network configuration, the Internet of Things devices become vulnerable in the network. They can be easily compromised and can also be attached to the Botnet network. IoT devices classification allows for strengthening of the overall network security through better VLAN planning and better firewall rule fine-tuning (e.g. per device class). In this paper only two classes of devices are considered: single-purpose devices (such as a bulb) and multi-purpose devices (such as mobile phone). Existing solutions do not provide the required accuracy within the given timeframe. We propose ML-based classification method based on supervised machine learning technology (Random Forest). With advanced packets flow analysis, our proposed approach demonstrates 94% of accuracy (7% better than the existing prior art). Additionally a very low False Positive rate is guaranteed for single-purpose IoT devices (e.g. a bulb must never be classified as a multi-purpose device).