Detection of Unauthorized IoT Devices Using Machine Learning Techniques

by   Yair Meidan, et al.

Security experts have demonstrated numerous risks imposed by Internet of Things (IoT) devices on organizations. Due to the widespread adoption of such devices, their diversity, standardization obstacles, and inherent mobility, organizations require an intelligent mechanism capable of automatically detecting suspicious IoT devices connected to their networks. In particular, devices not included in a white list of trustworthy IoT device types (allowed to be used within the organizational premises) should be detected. In this research, Random Forest, a supervised machine learning algorithm, was applied to features extracted from network traffic data with the aim of accurately identifying IoT device types from the white list. To train and evaluate multi-class classifiers, we collected and manually labeled network traffic data from 17 distinct IoT devices, representing nine types of IoT devices. Based on the classification of 20 consecutive sessions and the use of majority rule, IoT device types that are not on the white list were correctly detected as unknown in 96 classified by their actual types in 99 identified quicker than others (e.g., sockets and thermostats were successfully detected within five TCP sessions of connecting to the network). Perfect detection of unauthorized IoT device types was achieved upon analyzing 110 consecutive sessions; perfect classification of white listed types required 346 consecutive sessions, 110 of which resulted in 99.49 experiments demonstrated the successful applicability of classifiers trained in one location and tested on another. In addition, a discussion is provided regarding the resilience of our machine learning-based IoT white listing method to adversarial attacks.


page 1

page 2

page 3

page 4


IoT Device Identification Using Deep Learning

The growing use of IoT devices in organizations has increased the number...

IoT Device Identification Based on Network Communication Analysis Using Deep Learning

Attack vectors for adversaries have increased in organizations because o...

IoT or NoT: Identifying IoT Devices in a ShortTime Scale

In recent years the number of IoT devices in home networks has increased...

Discretization-based ensemble model for robust learning in IoT

IoT device identification is the process of recognizing and verifying co...

Blocking without Breaking: Identification and Mitigation of Non-Essential IoT Traffic

Despite the prevalence of Internet of Things (IoT) devices, there is lit...

IoTSense: Behavioral Fingerprinting of IoT Devices

The Internet-of-Things (IoT) has brought in new challenges in, device id...

Please sign up or login with your details

Forgot password? Click here to reset