Cross-Layer Protocol Fingerprint for Large-Scale Fine-Grain Devices Identification

Abstract

Internet-connected Internet of Things (IoT) devices are exploding, which pose a significant threat for their management and security protection. IoT device identification is a prerequisite for discovering, monitoring, and protecting these devices. Although the existing proactive identification methods based on protocol fingerprint can discover and identify large-scale IoT devices, the fingerprint granularity is difficult to meet the requirements of security risk assessment for large-scale IoT devices. Since IoT devices usually support multiple network protocols for specific collection and control tasks, we propose a cross-layer protocol fingerprint to achieve large-scale fine-grained devices identification instead of traditional single protocol fingerprint. We first design a probing scheme for gathering HTTP and TCP cross-layer packets. Then we select the specific field of the HTTP and TCP protocols based on the diversity and consistence of field value. Finally, we utilize convolutional neural network (CNN) and long-term memory network (LSTM) to extract and construct feature fingerprint of these specific fields, and achieve a fine-grain IoT devices identification with high accuracy. The experimental results show that our identification accuracy of devices model reaches 96.6%, the recall rate reaches 97.4%.

Fine-Grained Identification for Large-Scale IoT Devices: A Smart Probe-Scheduling Approach Based on Information Feedback

“…Each classifier is responsible for analyzing specific port data, which greatly shortens the cycle of device identification and increases the identification accuracy by 46.67%. Yu et al [11] used Convolutional Neural Networks (CNN) and Long Short-Term Memory Networks (LSTM) to extract and construct the characteristic fingerprints of HTTP and TCP cross-layer data packets to achieve high-precision and finegrained IoT device identification. In [13,[23][24][25][26][27][28][29][30], an inspection of data packets was used to extract device features.…”

“…DAN et al [11] proposed a cross-layer protocol fingerprinting technique for finegrained device identification. This approach utilized a convolutional neural network (CNN) and a long short-term memory network (LSTM) to extract and construct feature fingerprints.…”

“…With numerous types of IoT devices, it is difficult to enumerate all fingerprints manually. In prior works [10][11][12][13][14][15][16], traditional, traffic-based, and banner-based approaches have been used to discover and manage IoT devices.…”

IoT Device Identification Method Based on Causal Inference

“…Prior to this paper, there were also methods using multilayer network protocols for device identification [19], but their methods only considered correlation between fields and ignored causality, which led to the selection of redundant features for device identification. To solve these problems, this paper needs to find an IoT device identification method that can take into account time, labor cost, and feature selection causality.…”

“…Table 1 shows the key features of both device type and device model granularity selected in this paper for HTTP/TCP and SSH/TCP protocol clusters. In order to evaluate the effectiveness of the features selected by the feature selection method in this paper, the features selected by the causal feature selection method are compared with the traditional statistical-based feature selection algorithms Percentile [29], FWE [30], RFE [31], variance threshold [32], and Chi2 [33] and manually selected features [19]. The features selected under HTTP/TCP protocols were used in comparison experiments using the same classifier and training methods.…”