The Case for Retraining of ML Models for IoT Device Identification at the Edge

Abstract

Internet-of-Things (IoT) devices are known to be the source of many security problems, and as such they would greatly benefit from automated management. This requires robustly identifying devices so that appropriate network security policies can be applied. We address this challenge by exploring how to accurately identify IoT devices based on their network behavior, using resources available at the edge of the network.In this paper, we compare the accuracy of five different machine learning models (tree-based and neural network-based) for identifying IoT devices by using packet trace data from a large IoT test-bed, showing that all models need to be updated over time to avoid significant degradation in accuracy. In order to effectively update the models, we find that it is necessary to use data gathered from the deployment environment, e.g., the household. We therefore evaluate our approach using hardware resources and data sources representative of those that would be available at the edge of the network, such as in an IoT deployment. We show that updating neural network-based models at the edge is feasible, as they require low computational and memory resources and their structure is amenable to being updated. Our results show that it is possible to achieve device identification and categorization with over 80% and 90% accuracy respectively at the edge.

Toward Continuous Threat Defense: in-Network Traffic Analysis for IoT Gateways

“…When a fresh set of M/A tables is generated by the control plane, these rules are then written to the data plane, forming new inference thresholds and completing the update process. This approach differs from the classical model retraining [5] in terms of update location, model objective, and update requirements. In the classical method, retraining and updating the model involves loading the trained model file onto processors like CPU.…”

“…IoT gateways (with wireless/wired interface) close to end devices play a vital role in defending against emerging threats before they spread. However, to counter emerging attacks in gateway, state-of-the-art security measures focus primarily on accurate detection through methods like online learning or model retraining [4,5]. This leaves a gap in fast and flexible action enforcement against detected anomalies.…”

Data Transformation Schemes for CNN-Based Network Traffic Analysis: A Survey

“…These following batch of papers widely elaborated feature extraction approaches to form input vectors [54,59,62,131,132] (see Table 8).…”

“…Yet another publication written by Kolcun et al utilized vector of features as the CNN entry to deal with the traffic classification challenge in IoT [132]. There are a few models proposed, but only one meets the requirements of this review, the 4-Layer CDM.…”