PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets

Pedro Miguel Sánchez Sánchez, Jose María Jorquera Valero, Alberto Huertas Celdrán, Gérôme Bovet, Manuel Gil Pérez, Gregorio Martínez Pérez

arXiv:2008.03343v2cs.CR

TL;DR

Existing surveys did not jointly review device identification, misbehavior detection, component malfunction, and datasets across these areas. This article synthesizes device types, behavioral sources, techniques, and datasets, finding that machine and deep learning are dominant across the considered scenarios while important data and method gaps remain.

  • Problem

    Earlier surveys did not jointly address device identification and misbehavior detection, component malfunction, and datasets covering identification, intrusion, or malfunction detection.

    Source: §II · p. 2

  • Method

    The article comprehensively reviews devices, behavioral sources, datasets, and techniques used across device identification and misbehavior-detection scenarios.

    Source: §VIII · p. 25

  • Results

    Machine and deep learning techniques are dominant across the considered scenarios, while network data is prominent for attack detection and resource usage for fault detection.

    Source: §VIII · p. 25

  • Takeaways & Limitations

    Recent work increasingly uses network sources and ML/DL, but datasets for uncovered devices and sources and newer ML/DL approaches remain research needs.

    Source: §VIII · p. 25

    Public device-identification datasets mainly cover network communications, with a lack of modern, varied datasets based on other sources.

    Source: C. Future Challenges · p. 24

Abstract

from arXiv · show

In the current network-based computing world, where the number of interconnected devices grows exponentially, their diversity, malfunctions, and cybersecurity threats are increasing at the same rate. To guarantee the correct functioning and performance of novel environments such as Smart Cities, Industry 4.0, or crowdsensing, it is crucial to identify the capabilities of their devices (e.g., sensors, actuators) and detect potential misbehavior that may arise due to cyberattacks, system faults, or misconfigurations. With this goal in mind, a promising research field emerged focusing on creating and managing fingerprints that model the behavior of both the device actions and its components. The article at hand studies the recent growth of the device behavior fingerprinting field in terms of application scenarios, behavioral sources, and processing and evaluation techniques. First, it performs a comprehensive review of the device types, behavioral data, and processing and evaluation techniques used by the most recent and representative research works dealing with two major scenarios: device identification and device misbehavior detection. After that, each work is deeply analyzed and compared, emphasizing its characteristics, advantages, and limitations. This article also provides researchers with a review of the most relevant characteristics of existing datasets as most of the novel processing techniques are based on machine learning and deep learning. Finally, it studies the evolution of these two scenarios in recent years, providing lessons learned, current trends, and future research challenges to guide new solutions in the area.

I. INTRODUCTION

Device behavior fingerprinting is surveyed as a way to identify devices and detect cyberattacks, faults, and other misbehavior. The article reviews the field’s scenarios, data, techniques, and datasets, and traces its evolution and research challenges.

I. INTRODUCTION

  • Device identification and misbehavior detection are the two main scenarios, and each influences the behavioral sources, data, and techniques selected.Misbehavior may affect network communications or CPU usage; identification spans type, model, and individual-device granularity.Source: §I · pp. 1–2
  • The review analyzes representative recent work across device types, behavioral sources, data, and processing and evaluation techniques in identification and malfunction-detection scenarios.It also studies how the characteristics of identification and misbehavior or malfunction detection have evolved.Source: §I · p. 2
  • The article compares approaches for processing and evaluating fingerprints, amid a shift from statistical methods toward machine and deep learning.It examines which techniques are considered suitable for each application scenario.Source: §I · p. 2

II. MOTIVATION AND CONTRIBUTIONS

  • Earlier surveys did not jointly cover device identification and misbehavior detection, component malfunction, and datasets for identification, intrusion, or malfunction detection.The article identifies these gaps as motivation for a broader review.Source: §II · p. 2
  • The contributions cover behavior sources and device types, processing techniques, representative solutions, public datasets, and lessons, trends, and future challenges.The review organizes these topics around five research questions, Q1–Q5.Source: §II · p. 3

III. BEHAVIOR CHARACTERIZATION ANALYSIS

This section examines device behavior scenarios, the device types and data sources they involve, and the behavior dimensions used to build fingerprints. It distinguishes device identification by granularity, from device category to individual unit.

III. BEHAVIOR CHARACTERIZATION ANALYSIS

  • The section studies device identification and misbehavior detection, then aligns device types and behavior dimensions with those scenarios.Its stated aim is to characterize the most common behavior dimensions and characteristics in existing fingerprinting solutions.Source: §III · p. 3

A. Application Scenario

1) Device identification:

  • Device identification distinguishes categories such as computers or sensors, models with different hardware and software, and individual devices with identical capabilities.Individual identification relies on lower-level data, usually related to hardware variations during fabrication.Source: 1) Device identification · p. 4

2) Misbehavior detection:

Misbehavior detection covers cyberattack detection and malfunction or fault detection, with faults assumed to affect overall device behavior. The section also describes device categories and groups behavior sources into externally collected and in-device data.

2) Misbehavior detection:

  • Attack detection identifies anomalies against previously known normal behavior and may be deployed as a network-based or host-based IDS.Detected threats range from impersonation and spoofing to malware execution.Source: 2) Misbehavior detection · p. 4
  • Malfunction detection targets devices affected by failing components or services, including hardware damage, overload, or network issues.These solutions assume the fault will affect the device’s general behavior.Source: 2) Misbehavior detection · p. 4

B. Device Type

  • The device categories described include computers, mobile and embedded systems, ICS, IoT, cloud, SDN/NFV, containers, and clusters.The section notes that behavior collection varies with device hardware and software.Source: B. Device Type · p. 4

C. Behavior Source

  • The survey organizes behavior sources into externally collected and in-device sources, then compares the behavior data considered by each solution.It also describes source advantages and disadvantages and identifies solutions using each source.Source: C. Behavior Source · p. 5

1) Externally-collected behavior sources:

The survey contrasts externally collected sources with in-device monitoring, showing that source choice varies by application and device type. Network communications span identification and misbehavior detection, while lower-level sources are more restricted.

1) Externally-collected behavior sources:

  • Network communications are broadly usable and can be monitored for many devices at one gateway, but impersonation and encryption complicate analysis; they support model/type identification and attack/fault detection,,,,,, [15],,.Solutions range from traffic volume and IPs to packet headers, flow statistics, protocols, and payloads.Source: 1) Externally-collected behavior sources · p. 5
  • Clock skew supports individual-device identification,,,, but its distribution concentrates near zero, limiting its use as a sole source in large deployments.It is collected externally from device timestamps, including TCP, ICMP, and Wi-Fi beacon timestamps.Source: 1) Externally-collected behavior sources · p. 5
  • Electromagnetic signals are difficult to tamper with but require close-range collection; surveyed uses identify drone models and physical devices, with no device-behavior anomaly-detection solution identified,,,,,,.The survey distinguishes anomaly detection in the radio spectrum from device-behavior anomaly detection using radio signals.Source: 1) Externally-collected behavior sources · p. 5

2) In-device behavior sources:

  • HPCs, CPU percentage, system calls, software signatures, and sensor values serve both identification and misbehavior detection, while processor and sensor-hardware data are identification-only and resource-use and process-property data are detection-only.Sensor and actuator data can also expose environment failures or attacks, but interpreting it requires device- and scenario-specific environmental knowledge.Source: 2) In-device behavior sources · p. 6

IV. BEHAVIOR PROCESSING AND EVALUATION TECHNIQUES

The survey groups behavior processing into rule-based, statistical, knowledge-based, ML/DL, and time-series approaches, which may overlap. This section describes the first three approaches and their respective uses and trade-offs.

IV. BEHAVIOR PROCESSING AND EVALUATION TECHNIQUES

  • Processing can be centralized on a device or server, or distributed through approaches such as blockchain, distributed learning, or federated learning.The five technique categories are not mutually exclusive.Source: §IV · p. 6

A. Rule-based

  • Rule-based fingerprints encode expected behavior through static or historically derived rules, making them fast and simple but dependent on prior behavioral knowledge and poorly suited to complex, changing scenarios.They are used for device type or model definition and anomaly detection; examples include MUD files, permitted software, and resource-use thresholds.Source: A. Rule-based · p. 7

B. Statistical

  • Statistical processing extracts properties such as averages or quartiles and supports preprocessing and anomaly detection, but handles multidimensional data poorly and needs domain knowledge for consistent decisions.Examples include IQR, Euclidean distance, and Expectation Maximization for clustering or parameter estimation.Source: B. Statistical · p. 7

C. Knowledge-based

  • Knowledge-based approaches use ontologies and if-then reasoning to infer knowledge, offering explainability and handling incomplete data at the cost of longer processing and reduced scalability.Look-ahead algorithms and finite-state models, including Markov and n-gram models, are used mainly for behavioral anomaly detection.Source: C. Knowledge-based · p. 8

D. Machine Learning and Deep Learning

ML/DL methods are prominent in behavior fingerprinting, while time-series analysis models ordered measurements using a range of statistical and learning techniques. Their suitability depends on data structure, volume, and available resources.

D. Machine Learning and Deep Learning

  • ML/DL can model complex, multidimensional patterns and adapt to dynamic, heterogeneous scenarios, but decisions can be hard to explain and training requires data, time, resources, and parameter tuning.The survey describes both supervised learning, including classification and regression, and unsupervised learning for dimensionality reduction, clustering, and anomaly detection.Source: D. Machine Learning and Deep Learning · p. 8
  • The survey covers clustering for device-class inference, unlabeled-data anomaly detection, and MLP, autoencoder, RNN, and CNN architectures applied to device identification, behavior-anomaly detection, or recognition,,,,, [34],,, [76],,, [15], [81],,, [20],.t-SNE is used to speed up computations and derive new features,,.Source: D. Machine Learning and Deep Learning · p. 8

E. Time Series

  • Time-series methods analyze ordered measurements and may improve on single-value processing, but require substantial data and time; frequency-based methods analyze signals, while time-based methods model evolution.The survey names Fourier transforms, ARMA, Dynamic Time Warping, and RNN/CNN approaches as examples,,,,,, [15], [81],,, [20],,.Source: E. Time Series · p. 9
  • Rules and statistics suit limited, known actions and low-dimensional data; knowledge-based or ML/DL approaches suit complex feature relationships, while time series may help when measurement order matters.The selection also depends on data quantity, available resources, and feature correlations; a limited-action bulb is contrasted with a cloud service running varied tasks.Source: E. Time Series · p. 9

D. Machine Learning and Deep Learning

  • ML and DL are the leading processing-technique group and are gaining prominence, particularly DL for time-series processing of raw data without precalculated features.The survey reports 46.39% importance for ML/DL techniques, noting that solutions may use multiple techniques.Source: Figure 4 · p. 9

V. BEHAVIOR-BASED SOLUTIONS AND APPLICATIONS

The paper reviews representative behavior-based solutions by scenario, emphasizing IoT while noting that other devices may use the same data sources. It then frames device type or model identification as distinguishing categories whose members are treated as equivalent.

V. BEHAVIOR-BASED SOLUTIONS AND APPLICATIONS

  • The review compares solutions by scenario, device type, behavior source, monitored data, processing and evaluation algorithms, and result criteria, with particular attention to IoT devices.The authors note that other device types may be fingerprinted using the same data sources.Source: §V · p. 10

A. Device Type or Model Identification

  • For type or model identification, devices belonging to the same type or model are treated as equals, and the surveyed solutions are compared by characteristics, algorithms, and performance.Source: A. Device Type or Model Identification · p. 10

1) Network-based identification:

Device identification spans network and radio behavior for identifying types and models, as well as lower-level component behavior for distinguishing individual devices. Network-based approaches are prominent, while radio-based identification still needs further research to approach their reported performance.

1) Network-based identification:

  • Network-analysis approaches fingerprint IoT and ICS device types or models using statistical features, including TCP acknowledgment-to-application response and actuator operation times, semantic communication behavior, and automatically learned features from raw TCP packets.Source: 1) Network-based identification · pp. 10–11

2) Radio-based identification:

  • Radio-based model identification uses controller signals or radio communications, with studies applying DNNs and CNNs to classify drone models,,,.Source: 2) Radio-based identification · p. 11

B. Individual Device Identification

  • Individual-device identification distinguishes devices with the same hardware and software, often using lower-level features tied to hardware components.These approaches may also distinguish device types and models.Source: B. Individual Device Identification · p. 11

2) Radio-based identification:

  • Many type- and model-identification solutions report over 99% accuracy and F1-Score, while radio-based identification still needs further research to reach similar performance.The comparison covers device type and model identification solutions.Source: 2) Radio-based identification · p. 11, Table VI · p. 12

1) Processor-based identification:

  • Processor-based fingerprints use timing or output variation: CryptoFP compares repeated function-execution times, while sensor fingerprints compare output sequences under supplied voltage sequences [154].Sensor-model results varied with the amount of fabrication variability [154].Source: 1) Processor-based identification · p. 12

2) Clock-based identification:

Individual-device fingerprints use clock skew, resource usage, or electromagnetic signals, but fabrication variation and deployment scale can constrain uniqueness. Attack-detection approaches span multiple behavioral sources and methods, with network monitoring prominent among the described solutions.

2) Clock-based identification:

  • Clock skew can distinguish devices, but it is not always stable or unique; authors report that additional features may be needed, especially beyond small networks,.Clock-skew values in one study fell within ±30 ppm.Source: 2) Clock-based identification · p. 13

3) Resource usage-based identification:

  • Comparing CPU-usage graphs from a fixed benchmark with Dynamic Time Warping yielded 93.43% unique fingerprints.The work measured fingerprint stability using Shannon entropy and a stability measure.Source: 3) Resource usage-based identification · p. 13

4) Electromagnetic signal-based identification:

  • Radio-frequency traces distinguished six identical ZigBee devices, while another approach’s classification performance began degrading at 34 feet.A separate method required an external sensor within 16 mm of the CPU.Source: 4) Electromagnetic signal-based… · p. 13

C. Attack Detection

  • Attack detection covers network attacks, malware, malicious firmware changes, and unauthorized user interactions, using either deviation detection from normal behavior or classification of labeled data.Source: C. Attack Detection · p. 13

1) Network-based attack detection:

  • Network-based detection research covers suspicious-device identification from packet-derived flow fingerprints, monitoring of direct network attacks, attack/anomaly classification using MQTT protocol traces, and federated anomaly detection for compromised IoT devices [15].Source: 1) Network-based attack detection · pp. 13–15

4) Electromagnetic signal-based identification:

  • Many individual-identification approaches achieve high performance, but scalability can be difficult in large deployments because fabrication variations are limited within quality standards.The comparison covers individual-device identification solutions.Source: 4) Electromagnetic signal-based… · p. 13, Table VII · p. 14

2) Sensor-based attack detection:

Attack-detection fingerprints draw on sensor measurements, system calls and logs, and hardware performance counters. The reviewed approaches apply distance measures, machine learning, and sequence or frequency modeling to identify anomalous behavior.

2) Sensor-based attack detection:

  • Sensor-based approaches detect known or unknown attacks by comparing measurements with normal behavior or modeling time-series anomalies.Examples include Euclidean-distance detection on IoT sensor data, an LSTM-based GAN tested on SWaT, WADI, and KDD99 [20], and RNN detection using SWaT measurements.Source: 2) Sensor-based attack detection · p. 15

3) System calls, logs and software signature-based attack detection:

  • System-call and application-monitoring approaches model normal activity with call patterns, n-grams, or software snapshots to detect anomalies and malicious updates.BoSMoS monitored system-file calls at 300-second intervals, limiting modified software’s runtime to no more than 300 seconds.Source: 3) System calls, logs and software… · p. 15

4) Hardware event-based attack detection:

  • Hardware-performance-counter approaches model execution paths or control flow; ConFirm detected all tested firmware modifications with low resource overhead.Other approaches use an Extended Markov Model for collaborative anomaly detection [92] or CRC and state machines for embedded-software authentication.Source: 4) Hardware event-based attack detection · pp. 15–16

5) Resource usage-based attack detection:

Resource usage is a common source for detecting attacks in cloud and cluster systems, while fault detection varies by environment and behavioral source. Fault-detection solutions often use resource metrics or system logs for cloud, container, and microservice systems, and network or sensor data for IoT and ICS.

5) Resource usage-based attack detection:

  • Cloud and cluster attack detectors monitor CPU, network, process, or file behavior, using thresholds, clustering, statistical similarity, or window-based spike detection.An autoscaling detector trained on CPU statistics detected both of its two tested DoS and stress attacks.Source: 5) Resource usage-based attack detection · p. 16
  • Attack detection is the most varied behavior-fingerprinting scenario: network data is most used, but system calls and resource usage also matter, with classification and anomaly detection both represented.The review notes that evolving attack techniques create a need for new solutions.Source: 5) Resource usage-based attack detection · p. 16

D. Malfunction and Fault Detection

1) Network-based fault detection:

  • Network-based fault detection uses communication-derived features or behavioral templates to identify abnormal IoT devices and trigger alerts or mitigation.One approach was validated with simulated physical damage and mechanical exhaustion anomalies.Source: 1) Network-based fault detection · p. 16

2) Sensor-based fault detection:

  • Sensor-stream fault detection extracts windowed statistical features, clusters unlabeled data, and applies outlier detection to identify train-door failures.Source: 2) Sensor-based fault detection · p. 16

3) System log-based fault detection:

  • System-log fault detection uses execution traces or performance-metric logs; one study found high metric correlation during anomalies such as truncated cyberattacks or data backups.Source: 3) System log-based fault detection · p. 16

4) Resource usage-based fault detection:

  • Resource-based fault detectors use clustering, forecasting, dimensionality reduction, and classification on host or service metrics to identify failures and anomalies.An Online ARIMA approach recognized all introduced disk, HDD, CPU, and memory anomalies.Source: 4) Resource usage-based fault detection · pp. 16, 18
  • Resource usage and system logs are most used for faults in NFV, cloud, containers, and microservices; IoT and ICS faults use network or sensor data, and most solutions use anomaly detection.The distribution of analyzed solutions is also shown by scenario, behavior source, and publication year in Fig. 5.Source: 4) Resource usage-based fault detection · p. 18

VI. PUBLIC DATASETS

The survey reviews public device-behavior datasets by application scenario, monitored devices and sources, and data morphology. It finds network-heavy coverage across identification and anomaly detection, with notable gaps in other sources and in-device IoT behavior.

A. Device Identification Datasets

  • Identification datasets span IoT traffic, radio measurements, and network traces, including IoT Sentinel, IoT Traffic Traces, DroneRF, and spectrum captures.The reviewed datasets include repeated setup traffic for IoT devices and both raw and preprocessed radio-spectrum data.Source: A. Device Identification Datasets · p. 19
  • Five of seven device-identification datasets use network traces or features, and the survey identifies a gap in datasets for clock skew, system logs or events, and resource usage.The authors attribute network prevalence partly to external monitoring and the ubiquity of network interfaces.Source: A. Device Identification Datasets · p. 19, Table X · p. 20

B. Anomalous Behavior and Attack Datasets

  • Anomaly and attack datasets cover ICS testbeds, resource monitoring, and mobile malware, including SWaT and WADI logs, Bitbrains VM metrics, and Android traffic and logs.The reviewed material also includes the Electra railway-substation dataset and malware-related smartphone datasets.Source: B. Anomalous Behavior and Attack… · p. 21
  • DARPA 1998/1999, KDD99, NSL-KDD, and the UNM system-call dataset are widely used benchmarks, but their age limits relevance to current networks and attacks.The UNM dataset also lacks system-call arguments.Source: B. Anomalous Behavior and Attack… · p. 21
  • 35 datasets cover network communications or system calls/logs, while resource-usage and HPC sources remain underrepresented; IoT attack datasets are prominent, but none captures in-device IoT behavior.Some datasets contain both network and calls/logs sources and are counted in both groups.Source: B. Anomalous Behavior and Attack… · pp. 21–22

VI. PUBLIC DATASETS

  • Public datasets support cross-verification of proposed solutions and make evaluation data accessible to teams unable to collect it themselves.The survey notes that many studies instead use privately collected datasets.Source: B. Anomalous Behavior and Attack… · p. 22

VII. LESSONS LEARNED, TRENDS AND CHALLENGES

The survey finds that data-source suitability varies by identification granularity and anomaly type, while network communications and ML/DL are widely used. It also highlights the monitoring difficulty of individual devices and gaps in public dataset coverage.

A. Lessons Learned

  • Network communications are used in 85% of device model/type identification works and 54.28% of attack-detection solutions, but only 8.33% of individual identification and 15.38% of malfunction detection solutions.The survey attributes the lower use in the latter scenarios to network data lacking sensitivity to distinguish fine physical differences or malfunctions.Source: A. Lessons Learned · p. 23
  • Clustering is widely combined with ML/DL classification to derive device classes from unlabeled samples, and some attack and malfunction detectors also use it.The survey presents this as evidence of clustering's viability for deriving classes from unlabeled behavioral data.Source: A. Lessons Learned · p. 23
  • ML and DL are the main approaches for both classification and anomaly detection across device types, models, attacks, and faults.The survey describes these methods as flexible for inferring complex data patterns and as outperforming traditional processing methods.Source: A. Lessons Learned · p. 23
  • Individual-device identification requires sensitive lower-level features—such as system clocks, execution time, clock skew, or electromagnetic signals—that are usually complex to monitor.These features are needed to detect small physical differences arising during manufacturing.Source: A. Lessons Learned · p. 23
  • Misbehavior detection has no consensus approach: source and technique choices depend on anomaly type, with solutions using network data, system calls and logs, hardware events, or resource usage.Network is the most-used source, but the surveyed solutions remain heterogeneous.Source: A. Lessons Learned · p. 23
  • Public datasets mainly cover network, system calls, and logs; 35 datasets contain these sources, and most provide raw data rather than processed features.Some datasets include both network and calls/logs sources and are counted in both categories.Source: A. Lessons Learned · p. 23

B. Current Trends

The survey finds growing prominence for ML/DL, attack detection and device identification, and public dataset publication. It also identifies research challenges spanning privacy, dataset coverage, emerging methods, scalability, and security.

B. Current Trends

  • ML and DL account for 46.39% of technique importance and are used in 71.87% of identification and 62.5% of misbehavior-detection solutions.Their prominence is increasing as statistical and knowledge-based approaches lose importance.Source: B. Current Trends · pp. 23–24
  • Public dataset releases increased from 7 in 2011–2015 to 23 in 2016–2020.The paper relates this trend to the growth of AI, whose ML/DL methods are powered by datasets.Source: B. Current Trends · p. 24
  • Attack detection and type or model identification grew from 50% in 2017 to 85.71% in 2020.The paper attributes this trend to expanding IoT deployments, device heterogeneity, and new security issues.Source: B. Current Trends · p. 24

C. Future Challenges

  • Public datasets remain scarce for several tasks, and identification datasets especially lack sources beyond network communications.Only 45% of model/type identification, 16.66% of individual identification, 42.85% of attack detection, and 7.69% of malfunction-detection solutions used public datasets; the authors call for diverse, high-quality datasets.Source: C. Future Challenges · p. 24
  • Scalability challenges include poorer classification as monitored-device counts grow, centralized data loads, blockchain validation, and one-to-one statistical evaluation.The authors also note that most misbehavior-detection solutions propose no countermeasure, and few works secure behavior monitoring against attacks.Source: C. Future Challenges · p. 24
  • Device model and type may need protection where known vulnerabilities make targeted attacks a concern.The paper notes that privacy-leakage attacks can identify device model and type, and that device behavior analysis can reveal users’ activities.Source: C. Future Challenges · p. 24
  • Behavioral data and model privacy need attention, including user-activity inference and gaps in privacy-law coverage for device fingerprinting.The paper points to federated learning combined with differential privacy as a possible privacy-preserving approach.Source: C. Future Challenges · pp. 24–25
  • Future work could apply newer ML/DL approaches and account for the behavior of ML/DL models embedded in devices.Examples include UMAP, XGBoost, convolutional–recurrent architectures, and reinforcement learning; the paper says no analyzed solution used reinforcement learning.Source: C. Future Challenges · p. 25

VIII. CONCLUSIONS

The survey reviews device behavior fingerprinting across identification and misbehavior detection, synthesizing devices, sources, datasets, and techniques. It finds heterogeneous devices and data, widespread network sources and ML/DL, and continuing gaps in dataset coverage and newer methods.

Conclusions

  • Reviewed solutions span heterogeneous device types and behavioral sources, with network communications used by most solutions.The survey frames fingerprinting as addressing device identification at different granularities and misbehavior from cyberattacks or faulty components.Source: §VIII · p. 25
  • ML/DL approaches are gaining importance for their versatility and performance when enough training data is available, at the expense of statistical and knowledge-based solutions.The survey also identifies recurrent/convolutional layer combinations and reinforcement learning as approaches not yet applied in the reviewed area.Source: §VIII · p. 25
  • Network data dominate type/model identification and attack detection, while individual identification mainly uses clock skew and electromagnetic signals and fault detection mainly uses resource usage.ML/DL techniques are dominant across the considered scenarios.Source: §VIII · p. 25
  • Public behavioral datasets prominently use network sources and lack other sources such as resource usage and hardware events.The survey calls for more datasets covering devices and sources absent from recent datasets, including system logs in IoT devices or ICSs.Source: §VIII · p. 25
  • The authors plan scalable solutions for individual-device identification and cyberattack detection using privacy-preserving ML/DL, alongside publicly accessible datasets.They intend these datasets to improve current dataset diversity and quality.Source: §VIII · p. 25

Related papers

Loading 2008.03343v2…