Position paper: A systematic framework for categorising IoT device fingerprinting mechanisms

• Main Authors: Yadav, Poonam, Feraudo, Angelo, Arief, Budi, Shahandashti, Siamak F, Vassilakis, Vassilios G
• Format: Journal Article
• Language: English
• Published: 16-10-2020
• Subjects: Computer Science - Cryptography and Security; Computer Science - Networking and Internet Architecture
• DOI: 10.48550/arxiv.2010.08466

The popularity of the Internet of Things (IoT) devices makes it increasingly
important to be able to fingerprint them, for example in order to detect if
there are misbehaving or even malicious IoT devices in one's network. The aim
of this paper is to provide a systematic categorisation of machine learning
augmented techniques that can be used for fingerprinting IoT devices. This can
serve as a baseline for comparing various IoT fingerprinting mechanisms, so
that network administrators can choose one or more mechanisms that are
appropriate for monitoring and maintaining their network. We carried out an
extensive literature review of existing papers on fingerprinting IoT devices --
paying close attention to those with machine learning features. This is
followed by an extraction of important and comparable features among the
mechanisms outlined in those papers. As a result, we came up with a key set of
terminologies that are relevant both in the fingerprinting context and in the
IoT domain. This enabled us to construct a framework called IDWork, which can
be used for categorising existing IoT fingerprinting mechanisms in a way that
will facilitate a coherent and fair comparison of these mechanisms. We found
that the majority of the IoT fingerprinting mechanisms take a passive approach
-- mainly through network sniffing -- instead of being intrusive and
interactive with the device of interest. Additionally, a significant number of
the surveyed mechanisms employ both static and dynamic approaches, in order to
benefit from complementary features that can be more robust against certain
attacks such as spoofing and replay attacks.