Improved temporal IoT device identification using robust statistical features

Area of Science:

• Computer Science
• Network Security
• Machine Learning

Background:

• The proliferation of Internet of Things (IoT) devices necessitates robust methods for network identification and security.
• Current machine learning-based IoT identification solutions face performance degradation due to data drift, requiring costly retraining.
• Accurate IoT device identification is crucial for network visibility and enhancing overall network security.

Purpose of the Study:

• To develop a stable and effective feature set for identifying Internet of Things (IoT) devices.
• To improve the performance and reduce the retraining frequency of IoT device identification models.
• To optimize the learning process for easier integration of new IoT devices.

Main Methods:

• A novel feature set leveraging payload lengths to capture unique IoT device characteristics was developed.
• The proposed feature set was integrated with Random Forest and One-vs-Rest classifiers for optimized learning.
• Weekly dataset segmentation was employed to ensure rigorous and time-aware evaluation across different periods.

Main Results:

• The proposed feature set maintained over 80% accuracy across all evaluation weeks on the IoT Traffic Traces dataset.
• The approach demonstrated improved accuracy over time by +10.13% on the self-collected IoT-FSCIT dataset.
• The new feature set outperformed selected benchmark studies in IoT device identification.

Conclusions:

• The payload length-based feature set offers a stable and accurate solution for Internet of Things (IoT) device identification.
• This method enhances network security by providing reliable device identification with reduced computational overhead from retraining.
• The approach facilitates the efficient addition of new IoT devices to networks, improving adaptability and security.