Source-linked AI summary
Detection of Unauthorized IoT Devices Using Machine Learning Techniques
Yair Meidan, Michael Bohadana, Asaf Shabtai, Martin Ochoa, Nils Ole Tippenhauer, Juan Davis Guarnizo, Yuval Elovici
TL;DR
Organizations need automated detection of suspicious IoT devices because enterprise networks face diverse, mobile, and vulnerable devices that may not belong to an approved white list. The paper applies supervised machine learning to network-traffic features from labeled IoT devices, achieving high unauthorized-device detection and authorized-type classification accuracy, with reported transferability and adversarial resilience.
Problem
Organizations need an intelligent mechanism to detect IoT devices connected to their networks when those device types are absent from a trustworthy white list.
Method
The paper applies supervised machine learning to TCP/IP network-traffic data, using manually labeled traffic from 17 IoT devices representing nine device types.
Results
96% average unauthorized device-type detection and 99% white-listed device-type classification were achieved using majority voting over 20 consecutive sessions.
Takeaways & Limitations
Unauthorized IoT types were detected perfectly after 110 consecutive sessions, while classifiers trained in one location transferred successfully to devices in another.
Takeaways & Limitations
The lab included a limited variety of device types, so classifiers cannot be implemented as-is for other organizations and require enterprise customization.
Abstract
from arXiv · showhide
Security experts have demonstrated numerous risks imposed by Internet of Things (IoT) devices on organizations. Due to the widespread adoption of such devices, their diversity, standardization obstacles, and inherent mobility, organizations require an intelligent mechanism capable of automatically detecting suspicious IoT devices connected to their networks. In particular, devices not included in a white list of trustworthy IoT device types (allowed to be used within the organizational premises) should be detected. In this research, Random Forest, a supervised machine learning algorithm, was applied to features extracted from network traffic data with the aim of accurately identifying IoT device types from the white list. To train and evaluate multi-class classifiers, we collected and manually labeled network traffic data from 17 distinct IoT devices, representing nine types of IoT devices. Based on the classification of 20 consecutive sessions and the use of majority rule, IoT device types that are not on the white list were correctly detected as unknown in 96% of test cases (on average), and white listed device types were correctly classified by their actual types in 99% of cases. Some IoT device types were identified quicker than others (e.g., sockets and thermostats were successfully detected within five TCP sessions of connecting to the network). Perfect detection of unauthorized IoT device types was achieved upon analyzing 110 consecutive sessions; perfect classification of white listed types required 346 consecutive sessions, 110 of which resulted in 99.49% accuracy. Further experiments demonstrated the successful applicability of classifiers trained in one location and tested on another. In addition, a discussion is provided regarding the resilience of our machine learning-based IoT white listing method to adversarial attacks.
1 INTRODUCTION
IoT devices expand organizational capabilities while introducing vulnerabilities, making unauthorized and employee-connected devices a growing enterprise security concern. The paper motivates automated detection because large organizations cannot rely on manual monitoring alone.
- IoT adoption brings diverse benefits but also numerous information-security vulnerabilities and exploits.Computational limitations, discoverability, and expected proliferation increase the risks associated with connecting IoT devices to modern networks.
- Enterprise IoT security depends on controlling self-deployed devices that support applications such as security, energy management, and conferencing.Web-enabled devices can expand the organizational cyber attack surface; smart TVs are cited as an example involving privilege escalation.
- 25-50 percent of remote employees admit connecting at least one home IoT device to their enterprise network.BYOIoT is associated with wearables and creates cross-contamination risks when devices previously exposed to domestic malware connect to enterprise networks.
- The paper addresses enterprise IoT risks through automated white listing, followed by a method and empirical evaluation.The paper’s structure covers attack vectors, white listing, contributions, the proposed method, evaluation, and adversarial resilience.
2 SYSTEM AND ATTACK MODEL
The paper models a large enterprise exposed to unauthorized IoT connections, including devices compromised through untargeted or specifically targeted attacks. It assumes skilled attackers may attempt to bypass automated white listing with adversarial methods.
- The assumed environment is a typical large enterprise facing an increasing range of IoT-related cyber threats.The threat model focuses on local violations of organizational security policies rather than heavy-duty DDoS attacks.
- Untargeted attacks involve IoT devices previously infected by indiscriminate malware that spreads across devices.Cross-contamination is identified as a mechanism for this attack type.
- Specifically targeted attacks involve malware intentionally implanted before or during the device’s path to the consumer.Examples include supply-chain contamination and compromise of a particular device used later to access an organizational network.
- A skilled attacker might recognize automated white listing and attempt to bypass it through adversarial methods.The paper states that such attacks on the proposed mechanism are practically unattainable.
3 WHITE LISTING FOR IOT SECURITY
Because compromised devices create risk only when connected to organizational networks, the paper proposes automated IoT device-type white listing for large enterprises. Continuous traffic monitoring identifies each device type and supports authorization decisions.
- Large enterprises require advanced automated controls because employees, guests, and extensive premises make manual monitoring impractical.The proposed system can feed a SIEM for near-real-time network segmentation and access control.
- White listing is preferred because organizations can collect traffic from authorized device types for comparison with unlabeled production data.Black-list construction is less practical when unauthorized devices are not permitted to connect and therefore cannot provide reference traffic.
- The problem is to continuously identify each connected device’s IoT type and determine whether that type appears on the organizational white list.The resulting authorization decision can trigger actions such as network enforcement.
4 CONTRIBUTION
The paper contributes a TCP/IP-traffic-based machine-learning approach for IoT device-type white listing, evaluated across diverse devices and extended toward deployment and cross-location use. It reports high detection performance, transferability, and resilience to adversarial attacks.
- The method relies only on TCP/IP traffic data for IoT device-type classification.
- The authors describe the work as the first attempt, to their knowledge, to use network-traffic machine learning to detect unauthorized IoT devices.
- 17 different IoT devices representing nine device types were used to demonstrate classifier performance.The evaluation includes devices from different vendors and, in some cases, multiple models from one vendor.
- 100% of unauthorized IoT device types were detected as unknown after analyzing a moving window of 110 consecutive sessions.The authors state that deployment could issue an alert to an organizational SIEM within a few minutes of connection.
- Classifiers trained in one lab achieved high classification accuracy when applied to devices in a second lab in another country.The finding suggests use in new settings with new users and devices without additional training when the authorized-type list is unchanged.
- The proposed method is reported to be resilient to adversarial attacks.
5 PROPOSED METHOD
The proposed method treats IoT device-type identification as supervised multi-class classification, then applies thresholds and sequential majority voting to white-list authorized types and mark others unknown.
- IoT device identification is formulated as multi-class classification over white-listed types, assuming each authorized type is sufficiently represented in labeled training data.
- Random Forest is trained without prior feature selection, uses few input parameters, resists overfitting, and is configured with 500 trees.
- A single session is assigned to the highest-probability device type only when its posterior probability exceeds the optimized threshold; otherwise it is labeled unknown.
- For each IP stream, sessions are classified individually, and repeating the procedure over consecutive sessions with majority voting improves final device-type identification.
- Assumptions and limitations: The method assumes white-listed device types are represented in training data, collected traffic reflects benign activity, and current evaluation covers TCP/IP devices with limited device-type variety.
6 EVALUATION
The evaluation collected labeled IoT traffic, trained Random Forest classifiers on session features, and assessed unauthorized-device detection, authorized-type classification, feature importance, transportability, and adversarial resilience. Majority voting over 20 sessions achieved high average accuracy, while transportability and attack analysis exposed practical strengths and constraints.
- 6.1 Data Collection: Traffic was collected through Wi-Fi access points connected to a switch and router, with port mirroring recording packets to a local server.Wireshark was used to record the mirrored traffic for subsequent session-level feature extraction.
- 6.2 Model Evaluation and Results: The experiments covered nine IoT device types, with one type left out of the white list in each evaluation and classifiers trained on the remaining eight types.Each single-session multi-class classifier used an optimized threshold selected on validation data.
- 6.2 Model Evaluation and Results: 96% average unauthorized-type detection and 99% average white-listed-type classification were achieved using majority voting over 20 consecutive sessions.This improved the overall average from 94% unauthorized detection and 97% authorized-type classification under single-session evaluation.
- 6.2 Model Evaluation and Results: Security-camera types from multiple manufacturers reached 94% unauthorized detection, indicating recognition of cross-vendor device-type patterns.The result came from testing three security cameras representing two manufacturers.
- 6.3 Most Important Features: TTL-related features and the sent-to-received byte ratio were important discriminators across several studied IoT device types.The minimum server-sent TCP time-to-live and byte ratio showed differing class-conditional behavior for devices such as baby monitors, refrigerators, smoke detectors, and TVs.
- 6.4 Transportability of Classifiers: Classifiers transferred across labs, but unauthorized-TV detection reached 85% while unauthorized-security-camera detection reached 100% when trained in Lab A and tested in Lab B.White-listed TVs and security cameras were classified correctly in Lab B in 92% and 94% of cases, respectively.
- 6.5 Resilience to Adversarial Attacks: Adversarial evasion requires mimicking device traffic and obtaining similar server responses, potentially involving protocol reverse engineering or authentication.Attackers may also need to control external servers and communication channels closely enough to imitate important traffic features and bandwidth behavior.
7 DEPLOYMENT
The method can be integrated into organizational environments, with moving-window size governing the trade-off between classification accuracy and detection speed.
- The method is suited to SIEM integration, where unauthorized-device detections can trigger alarms or immediate network isolation.
- Wider moving windows generally improve accuracy, but their marginal utility diminishes after approximately 20 sessions.
- Unauthorized IoT device types were perfectly detected using 110 consecutive sessions, while five device types reached 100% accuracy within 20 sessions or fewer.The fast cases included TVs, sockets, and motion sensors.
- 99.49% accuracy was achieved for white listed types with 110 sessions, whereas perfect classification required 346 sessions.
- Detection time varies by device type because session rates differ across devices and over time, even with a fixed window size.
8 RELATED WORK
Prior IoT identification approaches use diverse signals and often address narrower or more predictable settings; this work instead uses network-traffic features for enterprise white listing.
- The paper positions its approach as more practical, less costly, and more discriminative among multiple device types than prior methods.
- Prior work includes MAC-address, authentication, RF-emission, and traffic-flow approaches for identifying or white-listing connected devices.
- Authentication-based white listing assumes known communication relations in industrial systems, whereas the targeted enterprise environment is more dynamic.
- RF-fingerprinting studies identify wireless sources, including identically manufactured network interface cards, rather than diverse IoT device types across vendors.
- Network-traffic features are proposed for IoT device type identification and white listing because traffic data is readily available within organizations.
- Several prior traffic-based studies use limited device varieties, restricted features, short setup stages, repetitive scenarios, or a single DNS feature.
9 SUMMARY AND CONCLUSION
The study applies supervised machine learning to network traffic for unauthorized IoT detection and evaluates accuracy, speed, transportability, and adversarial resilience.
- Seventeen IoT devices representing nine types were manually labeled to train and evaluate multi-class classifiers that identify unauthorized types as unknown.
- 96% average unauthorized-device detection accuracy and 99% average white-listed-type classification accuracy were obtained using majority voting over no more than 20 sessions.
- Unauthorized devices were perfectly detected with 110 sessions, while sockets and thermostats were detected using five sessions.
- Classifiers trained in one laboratory and tested in another country achieved accuracy levels similar to training and testing on all data.
- Future research will broaden device types, examine additional communication technologies, and test data from devices infected by attacks and malware.
A.1 IoT Devices Used in Experiments
The experiments used labeled traffic from 17 IoT devices, including a Beseye baby monitor and a Sony smartwatch listed in the device inventory.
- The device inventory records device number, type, manufacturer, model, laboratory, and number of sessions.
- Device 1 was a Beseye Baby Monitor Pro baby monitor deployed in Lab A, with 51,578 recorded sessions.
- Device 17 was a Sony SmartWatch 3 SWR50 watch deployed in Lab A, with 631 recorded sessions.
A.2 Features Found to be Important for IoT Device White Listing at Least Twice
Important features for IoT device white listing include TCP time-to-live statistics, traffic ratios, reset counts, host or server Alexa ranks, and session inter-arrival timing across device types.
- TCP time-to-live statistics include minimum, quartile, average, maximum, variance, and server-sent values.The listed TTL features include ttl_min, ttl_B_min, ttl_firstQ, ttl_avg, ttl_B_thirdQ, ttl_B_median, ttl_thirdQ, ttl_max, and ttl_B_var.
- Additional network features include the sent-to-received byte ratio, packets with the RST flag, and Alexa ranks for dominated hosts and SSL servers.
- Session inter-arrival timing is reported for refrigerators, sockets, TVs, thermostats, motion sensors, baby monitors, and security cameras.
- Mean session inter-arrival times range from 0 days 00:00:01.135635 for baby monitors to 0 days 00:04:08.519480 for motion sensors.The corresponding standard deviations range from 0 days 00:00:01.287092 for baby monitors to 0 days 00:10:14.900034 for motion sensors.