Analysis of encrypted wireless traffic for identification of IoT devices
Natalie M. Nakhla, Ronggong Song, Grant Vandenberghe, Md. Nazmul Islam, Susan Watson, Masoud Bozorgi, Ming Li · 2025
With the ever increasing presence of Internet of Things (IoT) devices in smart home and industrial applications, it is important to ensure the same level of security for these devices as it is for traditional network endpoints. However, since many IoT devices do not have the capability to authenticate themselves prior to joining a network, network defenders must rely on behavioural-based identification methods, known as fingerprinting, to detect their presence. Network-Based device fingerprinting involves collecting and understanding device behaviours, based on network packet characteristics such as packet structures and timing. However, highlighted challenges in network-based fingerprinting include high computational complexity due to the large number of features, and dynamic behaviour due to firmware updates and configuration settings.In this study, we propose a machine learning (ML)-based classification framework for device identification, using encrypted wireless network traffic. The proposed approach is comprised of a feature extraction capability, as well as two feature engineering methods, to transform the data for classification using ML methods such as random forest (RaF) and K-nearest neighbor (KNN). Since we are only considering wireless encrypted network traffic, we limit our analysis to a smaller set of features, thus avoiding the need for complex feature extraction mechanisms. We tested the proposed framework on a real world IoT testbed consisting of a dozen commercial IoT WiFi cameras. We show that by identifying a select set of key characteristics with effective feature engineering techniques, we achieve classification accuracy up to 99%, without the need for specialized computing resources or advanced artificial intelligence (AI) techniques. We further demonstrate that, despite firmware updates, we are still able to achieve good accuracy results. Future work includes extending the proposed approach to include fingerprinting of other types of IoT devices and protocols.