Poster: Understanding and Managing Changes in IoT Device Behaviors for Reliable Network Traffic Inference
Shayan Azizi, Norihiro Okui, Masataka Nakahara, Ayumu Kubota, Gustavo Batista, Hassan Habibi Gharakheili · 2024
Data-driven inference from network traffic is increasingly becoming a practical, cost-effective, and scalable method for various use cases, among them managing the cyber health of Internet-of-Things (IoT) networks. However, inference models trained on IoT device traffic patterns from constrained environments for limited periods may not accurately predict outcomes when new contexts are introduced or variations emerge in device behaviors. In our research, we begin by quantifying the changes in network behavior patterns across various IoT device types. This will help to explain whether, when, and how changes in the learned patterns can degrade predictions. Our preliminary experiments show that the effect of these changes on the performance highly depends on the way the model establishes its decision boundaries. We aim to develop techniques that facilitate the adaptation of trained models, enabling them to effectively address the evolution of behaviors in both temporal and spatial domains. Provided by a major Internet Service Provider (ISP) we have access to a dataset comprising nearly 400M IPFIX records from about 400 IoT devices, and collected from an IoT lab testbed, as well as 25 real smart homes from Feb'19 to Dec'23.