IoTDevID: A Behavior-Based Device Identification Method for the IoT

Abstract

Device identification (DI) is one way to secure a network of Internet of Things (IoT) devices, whereby devices identified as suspicious can subsequently be isolated from a network. In this study, we present a machine-learning-based method, IoTDevID, that recognizes devices through the characteristics of their network packets. As a result of using a rigorous feature analysis and selection process, our study offers a generalizable and realistic approach to modeling device behavior, achieving high predictive accuracy across two public data sets. The model’s underlying feature set is shown to be more predictive than existing feature sets used for DI and is shown to generalize to data unseen during the feature selection process. Unlike most existing approaches to IoT DI, IoTDevID is able to detect devices using non-IP and low-energy protocols.