Position paper: A systematic framework for categorising IoT

device fingerprinting mechanisms

Poonam Yadav Angelo Feraudo Budi Arief
University of York, UK University of York, UK University of Kent, UK

Siamak F. Shahandashti Vassilios G. Vassilakis

University of York, UK University of York, UK
ABSTRACT general purpose computing devices to track user behaviour and ap-
The popularity of the Internet of Things (IoT) devices makes it in- plication usage. Some of the interesting applications include browser
arXiv:2010.08466v2 [cs.NI] 19 Oct 2020

creasingly important to be able to fingerprint them, for example fingerprinting for web analytics, user tracking, fraud detection and
in order to detect if there are misbehaving or even malicious IoT accountability [9, 23, 27] and have gained a significant interests from
devices in one’s network. However, there are many challenges faced cyber-security community. While it is clear that device fingerprinting
in the task of fingerprinting IoT devices, mainly due to the huge can bring a lot of benefits – especially for providing automated and
variety of the devices involved. At the same time, the task can po- customisable user experience – there are also concerns that it can
tentially be improved by applying machine learning techniques for pose security and privacy risks [29, 39]. On the other hand, it has
better accuracy and efficiency. The aim of this paper is to provide a been suggested that device fingerprinting can also be used to help
systematic categorisation of machine learning augmented techniques improve the security of smart home automation [24].
that can be used for fingerprinting IoT devices. This can serve as a There are three main properties that need to be satisfied in order
baseline for comparing various IoT fingerprinting mechanisms, so to achieve effective fingerprinting of devices [50]:
that network administrators can choose one or more mechanisms ∙ unique identity property: the device fingerprint has to be
that are appropriate for monitoring and maintaining their network. unique for the device;
We carried out an extensive literature review of existing papers on ∙ integrity property: the fingerprints must be impossible – or at
fingerprinting IoT devices – paying close attention to those with least, difficult – to forge;
machine learning features. This is followed by an extraction of im- ∙ reproducibility property: the features used in the fingerprint-
portant and comparable features among the mechanisms outlined in ing process must be stable, especially in the presence of
those papers. As a result, we came up with a key set of terminologies environment changes and mobility.
that are relevant both in the fingerprinting context and in the IoT The increased prevalence of Internet of Things (IoT) devices
domain. This enabled us to construct a framework called IDWork, makes the task of fingerprinting devices more challenging. To start
which can be used for categorising existing IoT fingerprinting mech- with, there is a great variety of IoT devices available on the market,
anisms in a way that will facilitate a coherent and fair comparison and there are many different ways for them to operate. These pose a
of these mechanisms. We found that the majority of the IoT fin- challenge in creating a generic mechanism that can perform accu-
gerprinting mechanisms take a passive approach – mainly through rate fingerprinting of all IoT devices. Furthermore, there are some
network sniffing – instead of being intrusive and interactive with the fundamental differences between IoT devices and general comput-
device of interest. Additionally, a significant number of the surveyed ers (for which, more mature fingerprinting mechanisms have been
mechanisms employ both static and dynamic approaches, in order to developed). For example, IoT devices do not have many standard
benefit from complementary features that can be more robust against browser-based applications, which means many standard fingerprint-
certain attacks such as spoofing and replay attacks. ing mechanisms will not work for IoT devices. Moreover, many
IoT devices do not have a standard Graphical User Interface (GUI)
CCS CONCEPTS and they might even work autonomously in pervasive environments
• Security and privacy → Biometrics; • Networks → Layering; • without user’s direct control.
Computer systems organization → Sensor networks; • Comput- Due to resource constraints and insecure designs, IoT devices are
ing methodologies → Machine learning approaches; Modeling prone to be involved in cyber-attacks, ranging from being the target
methodologies; • General and reference → Measurement. [22, 45] to being exploited to create a botnet to mount a massive
Distributed Denial of Service attack [3, 16]. Therefore, it is necessary
KEYWORDS and desirable to be able to automatically detect whether certain IoT
Internet of Things (IoT), Fingerprinting, Machine Learning, Survey, devices might be vulnerable or could be exploited in cyber-attacks.
Framework, Device Identification, Network Traffic Analysis. The automatic device identification is one of the core requirements
for building a secure IoT ecosystem, including cyber-attack and
anomaly detection systems and automatic management and control.
1 INTRODUCTION Various device fingerprinting mechanisms have been proposed in
Device fingerprinting is a process of identifying a device or device the last few years. However, not all of these mechanisms are suitable
type based on its unique intrinsic or behavioural properties [18, for the IoT domain. Many IoT device fingerprinting mechanisms are
21, 50]. Device fingerprinting is very popular in internet-connected only suitable for specific use cases or tailored to certain requirements,
 P. Yadav et al.

making it challenging to choose a correct fingerprinting mechanism Edge/IoT Device Cloud Node

that will be appropriate for a new use case, for example. This short- Application Layer Application Layer
Network Gateway
coming is the motivation behind our paper. In this paper, we explore
and collate existing IoT fingerprinting mechanisms – especially those Network Layer Network Layer Network Layer

Extraction
Software
that leverage Machine Learning (ML) techniques – and present a

Feature
holistic view and terminologies used in the fingerprinting context,
MAC S/W Layer MAC S/W Layer MAC S/W Layer
which can be used for further research and development.
Physical Network Physical Network Physical Network
Contributions. The key contributions of our paper are:

Extraction
Layer / H/W (NIC) Layer / H/W (NIC) Layer / H/W (NIC)

Hardware
Feature
∙ The compilation of a key set of fingerprinting terminologies. H/W (CPU+ I/O+ Memory) H/W (CPU+ I/O+ Memory) H/W (CPU+ I/O+ Memory)
∙ The identification of important features to be included for
achieving effective and accurate fingerprinting of IoT devices.
∙ The construction of IDWork: a systematic framework for cat- Figure 1: Edge/IoT device network end-to-end components
egorising IoT device fingerprinting mechanisms, which can
be used for comparing and selecting suitable fingerprinting
mechanism(s) for an IoT application. the detection of anomalous user activities. The latter is based on fea-
tures such as packet size, packet inter-arrival time, and transmission
The rest of the paper is organised as follows. Section 2 provides rate.
some background and related work, while Section 3 outlines the Hamad et al. [21] perform IoT device identification using traffic
methodology we followed in our research. Section 4 represents the characteristics (network flows), based on real-time devices connected
core of our work, giving an overview of the IDWork framework, to an IP network. A passive behavioural fingerprinting approach is
along with the key terminologies and our results. Finally, Section 5 used, while device classification is based on features extracted from
concludes our paper and provides some ideas for future work. both packet header and payload. These include IP address, packet
size, and other traffic related features. The authors investigated dif-
ferent supervised learning classifiers such as ABOOST, LDA, KNN,
2 RELATED WORK
Decision Tree, Naive Bayesian, and SVM Random Forest (RF), with
Several papers have discussed various fingerprinting mechanisms, RF showing the best performance.
although they are not necessarily dedicated to IoT devices [15, 49,
50]. Cunche et al. [10] looked into device fingerprinting based on 3 METHODS
monitoring wireless probes that a device may make, based on the
preferred network (access points) stored on that device. The main Between March and June 2020, we carried out a systematic review of
concern of the paper was privacy infringement, for example by relevant papers that have been published on various venues, includ-
exploiting information contained in the fingerprint to infer social ing USENIX, ACM, IEEE, Nature, ScienceDirect, MDPI, Springer,
links between device owners. Spooren et al. [46] provides a critical Elsevier, and Hindawi. We also utilised Google Scholar for compari-
assessment of device fingerprinting for risk-based authentication. In son and for augmenting our search. The following keywords were
particular, they pointed out that device fingerprinting carries a lot of used to gather the initial set of papers: “IoT”, “fingerprinting”, “de-
similarity among mobile devices, making this approach less reliable vice identification”, “device authentication”, “device authorisation”,
for risk assessment and step-up authentication. “traffic filtering”, “anomaly detection”.
Ferrag et al. [14] looked at human physiological and behavioural We then divided up these papers among ourselves in order to
features in their investigation into factors that might hinder bio- analyse them and to extract key features of each paper. In order to be
metrics models’ development and deployment on a large scale for able to compare these papers fairly and consistently, we constructed
authenticating IoT devices. They classified related survey papers a framework we call IDWork, as outlined in Section 4.2. At various
based on deployment scope, focus biometric area, threat models, stages, we also performed synchronisation checks among ourselves
countermeasures, as well as the ML algorithms and Data Mining to make sure the process is robust and consistent.
methods used by existing authentication and authorisation schemes Further papers were added to the list between July and Septem-
for IoT devices. The paper also listed a set of biofeatures that can ber 2020, mostly as a result of following up cited papers by those
be used for biometric authentication of IoT devices, including gaze in the initial main list. The same analysis and extraction process
gestures, electrocardiogram, keystroke dynamics, fingerprint, ear using IDWork were applied to these additional papers to ensure
shape and hand geometry [14]. They focus only on biofeatures, so consistency.
other traits (such as network characteristics and device information) Our process came up with a final list of 31 articles from the 142
are not considered. papers that we analysed carefully. The papers in our final list are
Skowron et al. [45] study the information leakage exposed by shown in Table 1, which is constructed by populating a table as a
traffic fingerprinting attacks. They use features of statistical network result of applying our IDWork framework.
flows and ML. Hence, this approach is effective even when the IoT
traffic is encrypted. This approach relies on decision trees (CART 4 OVERVIEW OF IDWORK
classifier) and heuristically creates random forests out of 100 trees. For building IDWork, we systematically reviewed the literature and
The proposed approach aims at both device identification as well as recent state-of-the-art work to understand different terminologies
Position paper: A systematic framework for categorising IoT device fingerprinting mechanisms

used in IoT fingerprinting mechanisms. We simplified the presen- to learn possible data correlations for generalisation.
tation of IoT end-to-end ecosystem, as shown in Figure 1. The
Edge/IoT device – showing the TCP/IP networking stack – is par- Device vs Network vs Cloud Level: Fingerprinting approaches can
titioned horizontally. The upper partition represents software fea- act on different levels. Usually in the case of device-level fingerprint-
ture extraction, which is composed of application, networking and ing, the approach generates a device signature which relies on its
Medium Access (MAC) layers. The lower partition represents hard- hardware characteristics, e.g. Radio Signal or clock skew. When the
ware feature extraction comprising of two sub-layers - the first layer approach analyses network traffic – i.e. there is an additional entity
(upper) represents the features extracted from the Physical Network within the network that monitor the traffic to produce device pattern
Layer along with the firmware and hardware (Networking Interface – we refer to it as network-level fingerprinting. It is even possible
responsible for Link/Physical layer communication) layers and the that fingerprinting procedures are applied externally to a network so
second layer (lower) represents the hardware features which ex- that they can be executed on multiple networks. We refer to this case
plicitly use the hardware device. Similarly, same layer partition is as cloud-level figerprinting.
performed at Network Gateway and Cloud Node.
White-box vs Black-box Fingerprinting: White-box fingerprint-
ing is possible when we can directly access a device’s firmware
4.1 Fingerprinting terminology source code and then build a dynamic model of that device [28].
In this section, we explain the key terminology that is important to Black-box fingerprinting exploits the interaction between different
grasp, before we define the IDWork framework. layers (e.g. application layer and transport layer) to build devices’
fingerprints.
Passive vs Active Fingerprinting: In passive fingerprinting, we
collect information produced by a device and create an identification Unique Device Identification vs Type Identification vs Class Iden-
pattern by only observing the data coming from the device, i.e., no tification: Fingerprinting approaches can have different outputs de-
interaction with the device is carried out. In active fingerprinting, pending on the designer’s goal. In particular they can produce: a
we instigate the target device to produce useful information, e.g. by unique device identifier, device model or device class (devices with
making the device emit particular signals (at the physical-layer), or similar properties).
by producing packets which require a specific response from the
device (at the network-layer). Thus, the difference between the two Supervised vs Unsupervised ML-based Fingerprinting: Super-
methods is that the former uses a sniffer to capture and analyse traffic, vised learning involves labeled data, which means that a prior knowl-
but it does not send traffic to the target [52], while the latter sends edge about the classification of the learning data is provided. Con-
queries to the target and analyses the response. versely, unsupervised learning involves unlabeled data, so the ML
goal is to infer a suitable classification of the data involved as well
Static Feature vs Dynamic Feature Fingerprinting: A static fea- as classifying the data.
ture fingerprinting includes only features that do not usually change
over the time (e.g. MAC address), while dynamic feature finger- Radio vs MAC vs Network vs Application Layer: Radio finger-
printing uses dynamic features that can change over time such as printing exploits the unique characteristics in the radio signal emitted
inter-arrival time associated with data flow. by a device. MAC fingerprinting exploits the characteristics of the
data frames produced by a device (e.g. probe request in Wi-Fi). In
Adaptive vs Fixed Fingerprinting Algorithms: An “adaptive” fin- network fingerprinting, the network packet parameters are used to
gerprinting approach uses an algorithm that changes in response to build an identification pattern. Application fingerprinting approaches
certain conditions observed during the fingerprinting process. On the typically gather information to find out the device’s services and
other hand, when the fingerprinting process always uses the same operating system.
(deterministic) algorithm with pre-determined and constant parame-
ters for all cases observed, we can consider that as “fixed”. Open-world vs Close-world Evaluation: Open-world refers to any
approach that is able to identify IoT devices within a larger set of
Hardware Feature vs Software Feature Fingerprinting: The for- devices not only restricted to IoT devices. Closed-world is when
mer approach uses features that are extracted using special Physical identification is evaluated on data that is restricted to only IoT de-
Unclonable Function (PUF) circuits to capture hardware-intrinsic vices.
properties. The latter approach uses behavioural software properties,
which could be found in the network traffic generated by the IoT Network Packet vs Flow-based Features: A fingerprinting ap-
device. proach that relies on network traffic can use packet-based or flow-
based features, or both. Packet-based features use the content of
Rule-based vs ML-based Fingerprinting: In rule-based approaches, individual packet payloads and headers, whereas flow-based features
the fingerprinting criteria are mathematically-formalised in the form are based on temporal features of multiple packets coming from
of if-then-else rules. Such rules are often defined by thresholds and the same device, e.g. packet flow direction, inter-arrival time and
used to create fingerprints by capturing the correlation between the inter-packet length [33].
features/parameters. In ML-based fingerprinting, an ML model is
created using the input features/parameters, and trained on the data Network Packet Header vs Deep Packet Based Features: When
 P. Yadav et al.

fingerprinting involves packet payload we refer to it as using deep- A. Fingerprint Template Creation
packet features. Otherwise, when only packet header parameters are
used to build an identification pattern, we refer to it as using packet Feature Feature Feature
extraction creation store and
header features. access
Fingerprint
Input raw Features Fingerprint template
features
Encrypted vs Unencrypted Network Traffic: Some fingerprinting and method

approaches do not need access to the packet payload, i.e. they can
work on both encrypted and unencrypted packets. Conversely, others
are designed to work on encrypted and unencrypted packet payloads,
Fingerprint
such as the algorithm proposed by Robyns et al. [40] which exploits matching Success /
Input raw Features Fingerprint
per-bit entropy analysis (MAC address randomization). Furthermore, features Rejection

some approaches are able to extract the features required only if the
payload is not encrypted.
B. Live Fingerprint Creation C. Fingerprinting Verification

Real Devices vs Simulated: Fingerprinting approaches based on

deep-learning algorithms require a large amount of data to properly Figure 2: IoT device fingerprinting workflow.
identify devices. Moreover, budget constraints do not allow for a
large number of devices to produce an exhaustive dataset for eval-
uation purposes. Thus, tools to simulate IoT devices are used (e.g. – What is the fingerprint feature extraction and creation, or
Node-RED [25]). In this case, traffic flows and most of the important what is the storage location in the IoT end-to-end system, for
features of typical categories of IoT devices – such as fridges or example, on the device, at a network gateway or on a cloud
washing machines – can be simulated and used to build datasets. On server?
the other hand, if real devices are used, the results will be more rep- – What are the security, integrity, anti-tempering considerations
resentative of real-world scenarios, but the budgetary requirements when storing and accessing the pre-created fingerprints?
are higher as well. – What is the computational complexity of individual steps?
After careful consideration, we picked seven labels categorised
Testbed vs Real World Evaluation: Fingerprinting approaches are under three broad steps: fingerprinting methods, fingerprinting in-
developed either on testbeds or in real-world environments. The put features and fingerprinting output. We studied two categori-
latter approaches provide additional resilience and deployment cred- sations under fingerprinting methods, namely Passive (P)/Active
ibility for the fingerprinting algorithm. (A) fingerprinting and Static (S)/Dynamic (D) fingerprinting. Un-
der fingerprinting input features, we considered categorisation us-
4.2 IDWork Framework ing TCP/IP networking stack label and we used three choices:
MAC/Network/Application Layers under this label. We further anal-
The construction of IDWork started with an understanding of the
ysed these layers with two sub-labels with these choices: Packet/-
basic fingerprinting creation and verification workflow, as shown in
Dataframe/Flow and Header/Payload. We also explored the mech-
Figure 2. The fingerprinting process consists of three steps: (1) Fin-
anisms which use these sub-labels for fingerprint creation, and we
gerprint template creation and storage, (2) Live fingerprint creation,
categorise them as Rule-based or ML-based. We classify fingerprint
and (3) Fingerprint verification. We analysed different considerations
output into three categories: Class, Type and Unique.
under each step. The task of initial template creation is a one-time
As a summary, in this work we present seven important features
process. The live fingerprint creation process may or may not follow
(as shown in Table 1), which broadly allow for a systematic and
the same approach or steps; however, the general approach follows
consistent way for classifying IoT fingerprinting mechanisms into
these two sub-steps every time: feature extraction from the raw in-
logical categories. In total, there are potentially 432 exhaustive com-
put features, and fingerprint generation. In the fingerprint template
binations, but certain combinations are more prevalent than others.
creation, the final step involving template storage and access mecha-
We perceive these popular categories as the more promising ap-
nism is essential. In our work, we have considered different options
proaches that one should take in their effort to achieve a meaningful
under each sub-step (as shown in Figure 2), that differentiates one
fingerprinting exercise of IoT devices.
fingerprinting mechanism from another. Some of these options are
either implementation-related or real-time deployment-related and
5 CONCLUSION
they need to be considered, analysed and accessed before deciding
an appropriate fingerprinting process suitable for an IoT application. IoT fingerprinting has become an important research area, due to
Some of the important options we explored are: the increased prevalence of IoT devices. Fingerprinting mechanisms
serve as a key component in a network administrator’s effort to
– Does fingerprint feature extraction, or creation mechanism identify and categorise IoT devices, in order to be able to observe
need device access to gather fingerprinting raw input?
1 They use an ML algorithm only for evaluation purposes
– Does fingerprint feature extraction, or creation mechanism
2 Theirmechanism can also identify unique device events
need invasive mechanisms? 3A Physical Unclonable Function (PUF) is being used rather than any network traffic
– Does fingerprint feature extraction, or creation mechanism based approaches
need additional hardware? 4 They also use Flow in the shape of inter-arrival time
Position paper: A systematic framework for categorising IoT device fingerprinting mechanisms

Table 1: The classification of existing IoT fingerprinting mechanisms based on seven key categories

MAC/ Packet/ Class/

Passive/ Static/ Header/ Rule-based/ With respect to
Network/ DataFrame/ Type/
Active Dynamic Payload ML-based Papers the first two
Application Flow Unique
(Cat 1) (Cat 2) (Cat 5) (Cat 6) main features
(Cat 3) (Cat 4) (Cat 7)
P S N P H RB C+T [19]
P S N P H ML+RB C [11]1 Passive
P S N P+F H RB T [41] and
P S N F H ML C [2] Static
P S M+N P H+P ML C+T [6]
P D N F - ML C+T [17]
P D N P+F H+P ML C [47] Passive
P D M DF H+P RB U [43] and
P D M+N P H+P ML C2 [48] Dynamic
P D M+N+A P+F H+P ML+RB U [44]
A S N P H+P ML C+T [52] Active and Static
A D M DF P ML - [7]
Active and Dynamic
A D A P H+P RB C+T [13]
P S+D N P P ML T [4]
P S+D N P H+P ML C [35]
P S+D N F H ML U [32]
P S+D N P H ML C [5]
P S+D N P+F P ML C [36]
P S+D N F P ML U [26]
P S+D N P H+P RB C+T [20]
P S+D N P H ML U [8] Employing
P S+D N P+F H ML C [34] a combination of
P S+D N P+F H ML - [37] approaches
P S+D N P+F H+P ML C [30]
P S+D N P+F H+P ML C [12]
P S+D M+N+A P+F H+P ML C [1]
P S+D N P+F H+P ML C [42]
P S+D N P+F H+P RB C [51]
A S+D - - - RB C [31]3
P+A S+D N P4 H+P ML C [29]
P+A D N F H ML U [38]

and manage IoT devices in their network properly, especially in use a passive fingerprinting approach. This means a less intrusive
relation to pinpointing potential causes of security problems. approach is generally favoured. Furthermore, a dynamic approach
There are many existing IoT fingerprinting mechanisms available, – or a combination of both static and dynamic approaches – is very
but it is not easy to choose a suitable mechanism for one’s network, popular, quite possibly due to the need to fulfill a liveness property
because there is currently no consistent framework for analysing to minimise the risk of stale data or replay attacks. On the other hand,
these mechanisms. This is a gap that our paper aims to address. the least common mechanism seems to be based on a combination of
Firstly, we compiled a list of key terminologies that are essential in active and static approach. This could be because such a combination
understanding and analysing IoT fingerprinting mechanisms. From might be more prone to a spoofing attack.
there, we carefully constructed a framework called IDWork, which While we endeavoured to be as thorough and exhaustive as we
provides a frame of reference for a fair and consistent comparison can in our research, we are aware that there are some limitations in
of these mechanisms. And finally, we demonstrated the usefulness our work. For example, there are seven categories that we mainly
of our framework by populating a table with some example mech- consider in our framework, as presented in Table 1. However, it is
anisms. We mainly focused on the mechanisms that use Machine possible that there are other categories that need to be considered
Learning techniques. However, there are several mechanisms em- in more detail. Furthermore, our current classification is mostly
ploying Rule-based techniques that are worth mentioning. based on the software-related features of the IoT fingerprinting
There are several key insights that came up from our research. We mechanisms. It would be more complete if hardware-related features
found that the majority of existing IoT fingerprinting mechanisms
 P. Yadav et al.

– in particular, leveraging the Physical Unclonable Function (PUF) advances and future trends. Security and Communication Networks 2019 (2019).
features – are also considered. [15] Jason Franklin, Damon McCoy, Parisa Tabriz, Vicentiu Neagoe, J Van Randwyk,
and Douglas Sicker. 2006. Passive Data Link Layer 802.11 Wireless Device Driver
An interesting direction for future work is to look at the distri- Fingerprinting.. In USENIX Security Symposium, Vol. 3. 16–89.
bution and impact of IoT fingerprinting mechanisms and see if any [16] Josh Fruhlinger. [n.d.]. The Mirai botnet explained: How teen
scammers and CCTV cameras almost brought down the internet.
significant patterns emerge in terms of mechanisms that are more https://www.csoonline.com/article/3258748/the-mirai-botnet-explained-
popular or more effective, and how such patterns change over time. how-teen-scammers-and-cctv-cameras-almost-brought-down-the-internet.html.
Further work will also need to be carried out to validate our frame- [17] Tianbo Gu and Prasant Mohapatra. 2018. Bf-iot: Securing the iot networks
via fingerprinting-based device authentication. In 2018 IEEE 15Th international
work. This could be done by utilising publicly available datasets conference on mobile ad hoc and sensor systems (MASS). IEEE, 254–262.
(provided by some IoT fingerprinting mechanisms) in an experiment [18] Xiaodan Gu, Ming Yang, Yiting Zhang, Peilong Pan, and Zhen Ling. 2018. Fin-
to classify real-world IoT devices in a live setting. This will allow gerprinting Network Entities Based on Traffic Analysis in High-Speed Network
Environment. Security and Communication Networks 2018 (2018).
for the accuracy of existing mechanisms to be calculated, enabling a [19] Hang Guo and John Heidemann. 2018. Ip-based iot device detection. In Proceed-
fairer comparison of these mechanisms to be performed. Achieving ings of the 2018 Workshop on IoT Security and Privacy. 36–42.
[20] I. Hafeez, M. Antikainen, A. Y. Ding, and S. Tarkoma. 2020. IoT-KEEPER:
this will enable system administrators to justify their choices with Detecting Malicious IoT Network Activity Using Online Traffic Analysis at the
regard to which IoT fingerprinting mechanism(s) they would like to Edge. IEEE Transactions on Network and Service Management 17, 1 (2020),
employ in their network. 45–59.
[21] Salma Abdalla Hamad, Wei Emma Zhang, Quan Z Sheng, and Surya Nepal. 2019.
IoT Device Identification via Network-Flow Based Fingerprinting and Learning.
ACKNOWLEDGEMENT In 2019 18th IEEE International Conference On Trust, Security And Privacy In
Computing And Communications/13th IEEE International Conference On Big
Yadav and Feraudo are supported in part by "Data Negotiability in Data Science And Engineering (TrustCom/BigDataSE). IEEE, 103–111.
Multi-Mode Communication Networks" sub-awarded project funded [22] Ali Hariri, Nicolas Giannelos, and Budi Arief. 2019. Selective Forwarding Attack
by EPSRC grant EP/R045178/1. on IoT Home Security Kits. In Computer Security. Springer, 360–373.
[23] Thomas Hupperich, Davide Maiorca, Marc Kührer, Thorsten Holz, and Giorgio
Giacinto. 2015. On the Robustness of Mobile Device Fingerprinting: Can Mobile
REFERENCES Users Escape Modern Web-Tracking Mechanisms?. In Proceedings of the 31st
[1] A. Aksoy and M. H. Gunes. 2019. Automated IoT Device Identification using Annual Computer Security Applications Conference (Los Angeles, CA, USA)
Network Traffic. In ICC 2019 - 2019 IEEE International Conference on Commu- (ACSAC 2015). Association for Computing Machinery, New York, NY, USA,
nications (ICC). 1–7. 191–200. https://doi.org/10.1145/2818000.2818032
[2] S. Aneja, N. Aneja, and M. S. Islam. 2018. IoT Device Fingerprint using Deep [24] Arun Cyril Jose, Reza Malekian, and Ning Ye. 2016. Improving home automation
Learning. In 2018 IEEE International Conference on Internet of Things and security; integrating device fingerprinting into smart home. IEEE Access 4 (2016),
Intelligence System (IOTAIS). 174–179. 5776–5787.
[3] Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, [25] Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova, and Benjamin Turnbull.
Jaime Cochran, Zakir Durumeric, J. Alex Halderman, Luca Invernizzi, Michalis 2019. Towards the development of realistic botnet dataset in the internet of things
Kallitsis, Deepak Kumar, Chaz Lever, Zane Ma, Joshua Mason, Damian Menscher, for network forensic analytics: Bot-iot dataset. Future Generation Computer
Chad Seaman, Nick Sullivan, Kurt Thomas, and Yi Zhou. 2017. Understanding Systems 100 (2019), 779–796.
the Mirai Botnet. In 26th USENIX Security Symposium, USENIX Security 2017, [26] Jaidip Kotak and Yuval Elovici. 2020. IoT Device Identification Using Deep
Vancouver, BC, Canada, August 16-18, 2017. 1093–1110. https://www.usenix. Learning. In 13th International Conference on Computational Intelligence in
org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis Security for Information Systems (CISIS 2020). Springer International Publishing,
[4] Noah Apthorpe, Dillon Reisman, and Nick Feamster. 2017. Closing the blinds: New York, NY, USA, 76–86.
Four strategies for protecting smart home privacy from network observers. arXiv [27] Pierre Laperdrix, Nataliia Bielova, Benoit Baudry, and Gildas Avoine. 2020.
preprint arXiv:1705.06809 (2017). Browser Fingerprinting: A Survey. ACM Trans. Web 14, 2, Article 8 (April 2020),
[5] L. Bai, L. Yao, S. S. Kanhere, X. Wang, and Z. Yang. 2018. Automatic Device 33 pages. https://doi.org/10.1145/3386040
Classification from Network Traffic Streams of Internet of Things. In 2018 IEEE [28] Q. Li, X. Feng, R. Wang, Z. Li, and L. Sun. 2018. Towards Fine-grained Finger-
43rd Conference on Local Computer Networks (LCN). 1–9. printing of Firmware in Online Embedded Devices. In IEEE INFOCOM 2018 -
[6] Bruhadeshwar Bezawada, Maalvika Bachani, Jordan Peterson, Hossein Shirazi, IEEE Conference on Computer Communications. 2537–2545.
Indrakshi Ray, and Indrajit Ray. 2018. Behavioral Fingerprinting of IoT Devices. [29] Antonio Mangino, Morteza Safaei Pour, and Elias Bou-Harb. [n.d.]. Internet-
In Proceedings of the 2018 Workshop on Attacks and Solutions in Hardware scale Insecurity of Consumer Internet of Things: An Empirical Measurements
Security (Toronto, Canada) (ASHES ’18). Association for Computing Machinery, Perspective. ACM Transactions on Management Information Systems (TMIS)
New York, NY, USA, 41–50. https://doi.org/10.1145/3266444.3266452 ([n. d.]).
[7] Sergey Bratus, Cory Cornelius, David Kotz, and Daniel Peebles. 2008. Active [30] Samuel Marchal, Markus Miettinen, Thien Duc Nguyen, Ahmad-Reza Sadeghi,
behavioral fingerprinting of wireless devices. In Proceedings of the first ACM and N Asokan. 2019. AuDI: Toward Autonomous IoT Device-Type Identification
conference on Wireless network security. 56–61. Using Periodic Communication. IEEE Journal on Selected Areas in Communica-
[8] Anat Bremler-Barr, Haim Levy, and Zohar Yakhini. 2019. IoT or NoT: Identifying tions 37, 6 (2019), 1402–1412.
IoT Devices in a ShortTime Scale. arXiv preprint arXiv:1910.05647 (2019). [31] Cédric Marchand, Lilian Bossuet, Ugo Mureddu, Nathalie Bochard, Abdelkarim
[9] A. Crabtree, T. Lodge, and J. et al. Colley. 2018. Building accountability into Cherkaoui, and Viktor Fischer. 2017. Implementation and characterization of a
the Internet of Things: the IoT Databox model. Journal of Reliable Intelligent physical unclonable function for IoT: a case study with the TERO-PUF. IEEE
Environments 4 (2018), 39–55. Transactions on Computer-Aided Design of Integrated Circuits and Systems 37, 1
[10] Mathieu Cunche, Mohamed-Ali Kaafar, and Roksana Boreli. 2014. Linking (2017), 97–109.
wireless devices using information contained in Wi-Fi probe requests. Pervasive [32] Yair Meidan, Michael Bohadana, Asaf Shabtai, Martin Ochoa, Nils Ole Tippen-
and Mobile Computing 11 (2014), 56–69. hauer, Juan Davis Guarnizo, and Yuval Elovici. 2017. Detection of Unauthorized
[11] Bharat Atul Desai, Dinil Mon Divakaran, Ido Nevat, Gareth W Peter, and Mohan IoT Devices Using Machine Learning Techniques. arXiv:1709.04647 [cs.CR]
Gurusamy. 2019. A feature-ranking framework for IoT device classification. [33] N. Moustafa and J. Slay. 2015. UNSW-NB15: a comprehensive data set for
In 2019 11th International Conference on Communication Systems & Networks network intrusion detection systems (UNSW-NB15 network data set). In 2015
(COMSNETS). IEEE, 64–71. Military Communications and Information Systems Conference (MilCIS). 1–6.
[12] B. A. Desai, D. M. Divakaran, I. Nevat, G. W. Peter, and M. Gurusamy. 2019. A [34] Nizar Msadek, Ridha Soua, and Thomas Engel. 2019. IoT Device Fingerprinting:
feature-ranking framework for IoT device classification. In 2019 11th International Machine Learning based Encrypted Traffic Analysis. In 2019 IEEE Wireless
Conference on Communication Systems Networks (COMSNETS). 64–71. Communications and Networking Conference (WCNC). IEEE, 1–8.
[13] Xuan Feng, Qiang Li, Haining Wang, and Limin Sun. 2018. Acquisitional Rule- [35] T. D. Nguyen, S. Marchal, M. Miettinen, H. Fereidooni, N. Asokan, and A.
Based Engine for Discovering Internet-of-Thing Devices. In Proceedings of Sadeghi. 2019. DÏoT: A Federated Self-learning Anomaly Detection System
the 27th USENIX Conference on Security Symposium (Baltimore, MD, USA) for IoT. In 2019 IEEE 39th International Conference on Distributed Computing
(SEC’18). USENIX Association, USA, 327–341. Systems (ICDCS). 756–767.
[14] Mohamed Amine Ferrag, Leandros Maglaras, and Abdelouahid Derhab. 2019. [36] Jorge Ortiz, Catherine Crawford, and Franck Le. 2019. DeviceMien: Network
Authentication and authorization for mobile IoT devices using biofeatures: Recent Device Behavior Modeling for Identifying Unknown IoT Devices. In Proceedings
Position paper: A systematic framework for categorising IoT device fingerprinting mechanisms

of the International Conference on Internet of Things Design and Implementation [44] Arunan Sivanathan, Daniel Sherratt, Hassan Habibi Gharakheili, Adam Radford,
(Montreal, Quebec, Canada) (IoTDI ’19). Association for Computing Machinery, Chamith Wijenayake, Arun Vishwanath, and Vijay Sivaraman. 2017. Charac-
New York, NY, USA, 106–117. https://doi.org/10.1145/3302505.3310073 terizing and classifying IoT traffic in smart cities and campuses. In 2017 IEEE
[37] Gaetano Pellegrino, Qin Lin, Christian Hammerschmidt, and Sicco Verwer. 2017. Conference on Computer Communications Workshops (INFOCOM WKSHPS).
Learning behavioral fingerprints from netflows using timed automata. In 2017 IEEE, 559–564.
IFIP/IEEE Symposium on Integrated Network and Service Management (IM). [45] Monika Skowron, Artur Janicki, and Wojciech Mazurczyk. 2020. Traffic Finger-
IEEE, 308–316. printing Attacks on Internet of Things Using Machine Learning. IEEE Access 8
[38] S. V. Radhakrishnan, A. S. Uluagac, and R. Beyah. 2015. GTID: A Technique (2020), 20386–20400.
for Physical Device and Device Type Fingerprinting. IEEE Transactions on [46] Jan Spooren, Davy Preuveneers, and Wouter Joosen. 2015. Mobile device finger-
Dependable and Secure Computing 12, 5 (2015), 519–532. printing considered harmful for risk-based authentication. In Proceedings of the
[39] Jingjing Ren, Daniel J Dubois, David Choffnes, Anna Maria Mandalari, Roman Eighth European Workshop on System Security. 1–6.
Kolcun, and Hamed Haddadi. 2019. Information exposure from consumer iot [47] Vijayanand Thangavelu, Dinil Mon Divakaran, Rishi Sairam, Suman Sankar Bhu-
devices: A multidimensional, network-informed measurement approach. In Pro- nia, and Mohan Gurusamy. 2018. Deft: A distributed iot fingerprinting technique.
ceedings of the Internet Measurement Conference. 267–279. IEEE Internet of Things Journal 6, 1 (2018), 940–952.
[40] Pieter Robyns, Bram Bonné, Peter Quax, and Wim Lamotte. 2017. Noncooperative [48] Rahmadi Trimananda, Janus Varmarken, Athina Markopoulou, and Brian Demsky.
802.11 mac layer fingerprinting and tracking of mobile devices. Security and 2019. PingPong: Packet-Level Signatures for Smart Home Device Events. arXiv
Communication Networks 2017 (2017). preprint arXiv:1907.11797 (2019).
[41] Said Jawad Saidi, Anna Maria Mandalari, Roman Kolcun, Hamed Haddadi, [49] S. Wang, J. Wang, and Z. Yu. 2018. Privacy-Preserving Authentication in Wireless
Daniel J. Dubois, David Choffnes, Georgios Smaragdakis, and Anja Feldmann. IoT: Applications, Approaches, and Challenges. IEEE Wireless Communications
2020. A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild. 25, 6 (2018), 60–67.
In Internet Measurement Conference (IMC ’20). ACM. [50] Qiang Xu, Rong Zheng, Walid Saad, and Zhu Han. 2015. Device fingerprinting in
[42] Ola Salman, Imad H. Elhajj, Ali Chehab, and Ayman Kayssi. [n.d.]. A wireless networks: Challenges and opportunities. IEEE Communications Surveys
machine learning based framework for IoT device identification and ab- & Tutorials 18, 1 (2015), 94–104.
normal traffic detection. Transactions on Emerging Telecommunications [51] Poonam Yadav, Qi Li, Richard Mortier, and Anthony Brown. 2019. Network
Technologies n/a, n/a ([n. d.]), e3743. https://doi.org/10.1002/ett.3743 Service Dependencies in Commodity Internet-of-things Devices. In Proceedings
arXiv:https://onlinelibrary.wiley.com/doi/pdf/10.1002/ett.3743 of the International Conference on Internet of Things Design and Implementation
[43] Sandra Siby, Rajib Ranjan Maiti, and Nils Ole Tippenhauer. 2017. IoTScanner: (Montreal, Quebec, Canada) (IoTDI ’19). ACM, New York, NY, USA, 202–212.
Detecting Privacy Threats in IoT Neighborhoods. In Proceedings of the 3rd ACM https://doi.org/10.1145/3302505.3310082
International Workshop on IoT Privacy, Trust, and Security (Abu Dhabi, United [52] Kai Yang, Qiang Li, and Limin Sun. 2019. Towards automatic fingerprinting of
Arab Emirates) (IoTPTS ’17). Association for Computing Machinery, New York, IoT devices in the cyberspace. Computer Networks 148 (2019), 318–327.
NY, USA, 23–30. https://doi.org/10.1145/3055245.3055253