A holistic IoT device classification approach through spatial & temporal behaviors modelling

Traffic management is becoming increasingly complex due to the increasing diversity of IoT platforms and protocols supported by heterogeneous devices. Recently, device fingerprinting techniques for automatic device recognition leveraging on domain knowledge in TCP/IP and AI techniques are becoming more prevalent. However, existing machine-learning (ML) models have trained HTTP and TCP flows that are not correctly weighted. Besides, these models are trained with algorithms that can extrapolate temporal information; thus, they are not temporal aware. This paper presents a two-level machine learning pipeline (IoT Sense) for IoT device recognition, using (1) SVM and Decision Tree to model the spatial behaviors and (2) RNN to model the device-to-device temporal actions. The ground truth of the work is that the communication behaviors of IoT sensors, actuators, and devices are more deterministic using control plane traffic instead of data plane traffic. IoT devices commonly rely on SSDP, IoTivity, AllJoyn to discover neighbors and exchange devices' information. These device-to-device hello(s) are more predictable than traffic patterns induced by random usage behaviors. Deep learning (DL) models trained on raw traffic; without adding custom weightage to control packets; can be biased towards user-induced behaviors that eventually over-fit the resulting model. IoT Sense classify based on the connectivity pattern among IoT nodes using control plane traffic that includes discovery, handshake, and session establishment flows. IoT Sense is platform-agnostic since it operates on connection properties (TCPIP/layer 3) instead of protocols (like CoAP, MQTT). The experimental results show that the proposed context-aware model achieved accuracy up to 0.956 precision score with a 0.0957 recall rate in IoT devices classification.