PaperlayerView exact revision on arXiv

Source-linked AI summary

Machine Learning for the Detection and Identification of Internet of Things (IoT) Devices: A Survey

Yongxin Liu, Jian Wang, Jianqiang Li, Shuteng Niu, Houbing Song

arXiv:2101.10181v1cs.CRcs.AIcs.LG

TL;DR

Rogue IoT devices create security risks, while cryptographic protections are unavailable in some systems and can weaken when legitimate devices are compromised or keys are disclosed. This survey synthesizes machine-learning approaches for non-cryptographic device identification and rogue-device detection from passive traffic and wireless signals. It organizes the literature into four categories and highlights enabling technologies and open issues, including continual learning, anomaly detection, deep unsupervised learning, explainability, and limited benchmarks.

  • Problem

    Non-cryptographic IoT device identification and rogue-device detection remain challenging because deployments and device specifications vary, while existing machine-learning methods require adaptation for IoT.

  • Method

    The paper surveys machine-learning technologies using passively collected network traffic traces and wireless signals, organizing them into four identification and detection categories.

  • Results

    The survey identifies continual learning, abnormality detection, deep unsupervised learning, and explainability as key developing trends and concludes that a multiperspective framework is needed.

  • Takeaways & Limitations

    Future rogue-device research must address challenges beyond signal processing by incorporating advanced artificial intelligence and knowledge discovery.

  • Takeaways & Limitations

    The survey finds limited benchmark datasets containing raw signals or network traffic traces across diverse scenarios.

Abstract

from arXiv · show

The Internet of Things (IoT) is becoming an indispensable part of everyday life, enabling a variety of emerging services and applications. However, the presence of rogue IoT devices has exposed the IoT to untold risks with severe consequences. The first step in securing the IoT is detecting rogue IoT devices and identifying legitimate ones. Conventional approaches use cryptographic mechanisms to authenticate and verify legitimate devices' identities. However, cryptographic protocols are not available in many systems. Meanwhile, these methods are less effective when legitimate devices can be exploited or encryption keys are disclosed. Therefore, non-cryptographic IoT device identification and rogue device detection become efficient solutions to secure existing systems and will provide additional protection to systems with cryptographic protocols. Non-cryptographic approaches require more effort and are not yet adequately investigated. In this paper, we provide a comprehensive survey on machine learning technologies for the identification of IoT devices along with the detection of compromised or falsified ones from the viewpoint of passive surveillance agents or network operators. We classify the IoT device identification and detection into four categories: device-specific pattern recognition, Deep Learning enabled device identification, unsupervised device identification, and abnormal device detection. Meanwhile, we discuss various ML-related enabling technologies for this purpose. These enabling technologies include learning algorithms, feature engineering on network traffic traces and wireless signals, continual learning, and abnormality detection.

I. INTRODUCTION

Rogue IoT devices threaten connected systems, while cryptographic protections may be unavailable or weakened by key disclosure and device compromise. The survey therefore organizes machine-learning approaches for non-cryptographic device identification and rogue-device detection, emphasizing passively collected traffic and wireless signals.

  • Rogue IoT devices can falsify identities or compromise legitimate devices to access resources and participate in attacks such as DDoS.
  • Cryptographic authentication depends on secure keys and may require modifications unavailable in existing systems, motivating non-cryptographic identification methods.
  • Flexible deployments and diverse device specifications make it difficult to derive general distinctive features from signals or network traffic.
  • The survey covers machine learning for device detection and identification using passively collected traffic traces and wireless signals accessible to network operators and surveillance agents.
  • It classifies approaches into device-specific pattern recognition, deep-learning identification, unsupervised identification, and abnormal-device detection.
  • The survey also discusses statistical learning, feature engineering, digital signal processing, deep learning, continual learning, unsupervised learning, and anomaly detection.

II. THREAT MODE OF ROGUE DEVICES IN IOT

Rogue-device threats progress through attack stages that exploit IoT connectivity, vulnerabilities, and observable behavior. The section presents device-identification and detection requirements alongside traffic-, activity-, and signal-based countermeasures and their practical limitations.

  • Device detection must verify legitimate identities, detect unknown or falsified devices, and identify compromised devices through abnormal behavior.
  • IoT attack chains include penetration, spying, data analytics, planning, and attack stages, enabling adversaries to exploit vulnerable peers and study device behavior.
  • A. Device type identification: Remote-service requests, activity patterns, and network flows provide features for identifying device types, including 28-device Bayesian classification and 95% accuracy for 20 devices with combined features.
  • A. Device type identification: Static MUD profiles can describe network behavior for device-type verification or attack detection, but firmware upgrades and extensions can change traffic patterns.
  • A. Device type identification: Device-type identification does not necessarily establish device identity, making behavior-independent specific-device identification important.

B. Feature-based statistical learning for specific device identification

Feature-based statistical learning formalizes wireless IoT device identification as classification using received-signal representations and engineered physical-layer features. Signal processing reconstructs in-phase and quadrature components, derives instantaneous characteristics, and exposes device-specific patterns for identification.

  • IoT device identification can be formalized as a classification problem using a generic signal-reception pipeline.
  • Software-Defined Radios provide multipurpose front-ends for handling modulation and baseband encoding in wireless device identification.
  • Wireless signals are represented through in-phase and quadrature components, I(t) and Q(t), to capture different modulation schemes.
  • Quadrature demodulation reconstructs I(t) and Q(t), enabling derivation of instantaneous amplitude, phase, and frequency.
  • Manufacturing imperfections and channel characteristics distort amplitude, phase, and frequency, creating side channels for wireless device identification.

2) Hardware imperfections:

Hardware imperfections and channel effects provide wireless fingerprints for device identification, including error, persistent, transient, and channel-state features. These features can be informative but may depend on protocols, device locations, propagation environments, and available hardware.

  • Hardware imperfections: Wireless-front-end imperfections influence signal waveforms without necessarily degrading communication, creating physical unclonable features for device identification.
  • Hardware imperfections: Error-based approaches use discrepancies between expected and received signals, including PLL phase errors, to construct device-specific features.
  • Hardware imperfections: Persistent-pattern methods such as RF-DNA form fingerprints from statistics of consecutive signal subregions, including variance, skewness, and kurtosis.
  • Hardware imperfections: Protocol-agnostic regions such as preambles help prevent persistent-feature models from embedding protocol-dependent information.
  • Hardware imperfections: Transient features are harder to forge but can vary with device location because coupled wireless-channel and RF-front-end characteristics change.
  • Channel state features: Channel-state features describe propagation-related distortions, while CSI exposes phase, frequency, and amplitude responses used in transmitter identification.
  • Channel state features: Channel-state identification remains challenging in indoor or mobile environments because obstacle motion affects features and channel characteristics are environment-oriented.
  • Channel state features: CSI research commonly depends on limited NIC categories, although generic SDR transceivers have been used to identify more than 50 NICs.

4) Cross domain features:

Cross-domain approaches transform wireless signals into alternative representations, including time-frequency, wavelet, frequency, and bispectral domains, then apply statistical classifiers and dimensionality reduction. These transformations aim to expose more distinguishable device patterns under differing signal conditions.

  • Cross domain features: Time-frequency remapping combines the STFT or Discrete Gabor Transform with classifiers such as SVM for transceiver identification.
  • Cross domain features: Wavelet, frequency-based, PCA, SVM, and Probabilistic Neural Network methods provide alternative domains and classifiers for device identification.
  • Cross domain features: Bispectrum-based energy entropy and color moments with SVM can theoretically improve identification under low SNR, while SIB is reported as more noise-robust.

5) Hybrid methods:

Hybrid methods combine features across domains and increasingly use automatic selection or deep learning to improve identification while addressing redundancy and model complexity. Deep neural networks can learn latent features from engineered or raw signals, but require substantial data and face interpretability and robustness challenges.

  • Hybrid methods: Hybrid methods combine features from multiple signal domains with classifiers such as k-NN and SVM to derive device-identification models.
  • Hybrid methods: Automatic feature selection removes irrelevant information; properly selected features enabled an 80% reduction of redundancy.
  • Hybrid methods: Hybrid feature approaches show superior performance under various influential factors because automatic selection can remove irrelevant information and optimize feature combinations.
  • Hybrid methods: Large feature combinations can reduce interpretability and create computationally difficult models to retrain for operational variations.
  • Deep Learning enabled device identification: Deep neural networks use convolutional layers to extract latent features and fully connected layers to produce final classification results.
  • Deep Learning enabled device identification: CNNs can achieve high accuracy from raw I/Q signals and surpass SVM and Logistic Regression, although movement and varying amplitudes degrade performance.
  • Deep Learning enabled device identification: Deep Learning methods typically require datasets estimated at 10,000 to 30,000 times the number of devices, though this estimate is rough.
  • Deep Learning enabled device identification: Complex-valued neural networks surpassed regular real-valued networks, while zero-bias dense layers maintained equivalent accuracy and improved unknown-device detection.

2) Open issues in Deep Learning for IoT device identification:

Deep Learning offers a unified way to handle high-dimensional IoT device-identification features, but practical deployment remains constrained by hyperparameter tuning, architecture design, unknown devices, and continual adaptation.

  • Hyperparameter searching: Hyperparameters, including learning rate, mini-batch size, dropout rate, and architectural parameters, substantially influence Deep Learning performance.The cited comparison reports CNN performing best, followed by DNN and LSTM, when using raw I/Q signals for device identification.
  • Hyperparameter searching: Hyperparameter optimization is computationally expensive, motivating grid, random, prediction-based, and evolutionary search strategies.Grid search is inefficient because it cannot rapidly prune useless parameter combinations, while random search can outperform it when few parameters matter.
  • Neural network architecture search: Network Architecture Search explores how neural-network structure should be designed, using pruning, progressive growth, heuristic search, reinforcement learning, and differentiable spaces.These approaches target the architecture-design problem, which defines the network’s information flow and can involve very large search spaces.
  • Open-set recognition and continual learning: Open-set recognition addresses classifiers’ inability to recognize novel devices absent from training data, while incremental learning can classify newly registered devices.The survey notes potential detection of a limited number of untrained devices through these approaches.
  • Continual learning: Transfer learning fine-tunes laboratory-pretrained networks for deployment, whereas continual learning incrementally incorporates new data without forgetting earlier knowledge.Transfer learning is associated with deploying new signal-identification systems, while continual learning supports regular software updates and maintenance.
  • Summary: Deep Learning remains an imperfect solution, but its unified development pipeline and ability to handle high-dimensional features provide balanced practical benefits.The survey also reports advantages for continual learning and abnormality detection relative to most statistical learning algorithms.

D. Unsupervised device detection and identification

Unsupervised device detection is designed for settings without directly available device identities. Its workflow engineers signal or behavior features, models latent structure, and matches new observations to clusters or abnormalities.

  • Motivation: Unsupervised identification is needed when device identities are unavailable, unlike supervised methods that learn legitimate-device features in advance.The survey divides unsupervised approaches into device behavior modeling and signal propagation pattern modeling.
  • Characteristics: Unsupervised training data need not directly identify device identifiers or types, and the number of devices may be unknown beforehand.These properties distinguish the setting from supervised device-identification schemes.
  • Workflow: The workflow consists of feature engineering, latent-space modeling, and matching inputs to likely clusters or reporting abnormalities.Latent-space models may include cluster centers, probability distributions, decision boundaries, or state-transition models.

1) Device behavior modeling:

Device behavior modeling extracts distinctive operational features and uses unsupervised learning to discover device groupings, primarily from upper-layer network behavior.

  • Device behavior modeling: Device behavior modeling extracts distinctive input features and estimates the number of different devices with unsupervised learning algorithms.Physical-layer signals provide limited information for this modeling approach.
  • Device behavior modeling: Flow-level network telemetry can be reduced with Principal Component Analysis and clustered adaptively to identify representative components and centers for device types.A conflict-resolution mechanism associates device types with corresponding cluster centers.
  • Device behavior modeling: An LSTM autoencoder can map device TCP traffic into a representative feature space, after which clustering and probabilistic modeling associate new data with known clusters.The approach learns natural clusters from training samples before assigning new observations probabilistically.

2) Signal propagation pattern modeling:

Signal propagation modeling uses localization or propagation-related patterns to assess device identity, but it provides indirect evidence and faces deployment limitations in complex environments.

  • Signal propagation pattern modeling: Wireless localization can assess whether a packet originates from its claimed device when device positions are unique and known in advance.The survey compares commonly used device-localization methods for IoT.
  • Signal propagation pattern modeling: Propagation modeling can detect devices from path-loss or attenuation patterns, including similar received-signal-strength trends for transmitters at the same location.The cited approach converts signal-strength measurements into time series and applies Dynamic Time Warping for alignment.
  • Signal propagation pattern modeling: Power-spectrum-density coefficients can be modeled as mixtures of Gaussian and propagation-related distributions, with Expectation-Maximization estimating contributing transmitters.The model operates on each device’s coefficients within a specific time window.
  • Limitations: Propagation-pattern modeling provides only indirect evidence for whether signals come from devices with nearby locations or similar propagation paths.Its complicated deployment environments limit commercial IoT use, although it has been applied to prevent identity spoofing in ADS-B systems.
  • Open issues: Unsupervised identification still requires feature engineering, and its effectiveness for distinguishing devices of the same model needs further investigation.The survey characterizes the approach as promising but requiring substantial investigation.
  • Abnormal device detection: Abnormal-device detection complements identity verification by comparing operational data against reference models to identify significant deviations.The approach is used to alert ongoing attacks and discover system vulnerabilities.
  • Abnormal device detection: MUD profiles reduce normal-behavior modeling costs by exposing expected network-flow patterns and enabling monitoring of behavioral changes.They can be dynamically generated, validated, and compared for commercial IoT devices.
  • Abnormal device detection: A MUD- and PCA-based detector triggered exceptions when traffic patterns left learned boundaries or state transitions violated reference models, accurately detecting several volumetric attacks.The method combines one-class spaces, X-Means, and Markov chains to model device behavior.

B. Reconstruction Approaches

Reconstruction approaches learn normal device-operation patterns and flag unknown scenarios or behavioral deviations through high reconstruction errors. The broader section frames abnormality detection as useful but still challenged by unknown devices, feature selection, and post-processing decisions.

  • B. Reconstruction Approaches: Reconstruction models learn normal device-operation patterns and produce low reconstruction errors for expected behavior but high errors for unknown or deviating scenarios.Deep autoencoders are generally used to memorize normal schemes.
  • B. Reconstruction Approaches: Prediction approaches model each device’s operational data as multidimensional time series and identify hijacking through high prediction errors.Device-specific predictors are trained on normal operation records.
  • B. Reconstruction Approaches: CNN, autoregression, autoencoder-LSTM, and predictive-coding models analyze traffic or wireless time-frequency streams for abnormal behavior.Predictive-coding models can specify attack types from the spatial distribution of reconstructed-frame error pixels.
  • Open issues: Manual behavioral-feature selection cannot guarantee sensitivity to future unknown intrusions.This concern motivates further work on feature selection and unknown-device recognition.
  • Open issues: Abnormality metrics require case-specific threshold or aggregation-window processing that balances true positives, false negatives, and response latency.Cross-validation can tune these parameters, but the processing issue remains open.
  • Open issues: Fixed-dataset models can produce wrong answers for novel devices, while devices from identical manufacturers may share behavior patterns that impede identity verification.Unknown-device recognition is presented as necessary for practical deployment.

2) Continual learning on new devices:

Continual learning aims to add newly registered devices without retraining on large datasets containing old and new devices. Its challenges include model capacity, dynamic expansion, deployment variation, wireless-channel dependence, and limited benchmark data.

  • 2) Continual learning on new devices:: Continual learning adds newly registered devices without retraining on a large dataset containing old and new devices.Retaining old data or deriving replay generators is computationally expensive.
  • 2) Continual learning on new devices:: Black-box models face unresolved limits on how many devices they can memorize.The capacity question is especially relevant to deep neural networks.
  • 2) Continual learning on new devices:: Dynamic model expansion is difficult for deep neural networks, whereas nearest-neighbor algorithms natively support continual learning.Adding devices changes the model requirements over time.
  • Deployment variation: Deployment-site and laboratory differences can impair identification accuracy, especially for wireless signals affected by channel characteristics.Suggested responses include channel-independent features, fine-tuning, data augmentation, and multi-domain training.
  • Reliable benchmark datasets: Benchmark datasets remain limited across diverse scenarios, although available datasets include raw signals from more than 100 airborne transponders and traffic traces from more than 30 IoT devices.The datasets support more reliable algorithm comparisons and transfer to specific applications.

B. Challenges in feature engineering

Feature engineering must address robustness, changing wireless channels, generative spoofing, explainability, continual adaptation, and adversarially learned verification patterns. The survey therefore calls for multiperspective frameworks combining machine learning with broader AI and knowledge-discovery techniques.

  • 1) The robustness of features:: Few studies evaluate feature robustness across device mobility, temperature, obstacles, and other varied scenarios.Robustness is especially consequential for physical-layer wireless identification.
  • 2) Making use of time-varying features:: Mobile channel variation can impair static-channel identification, while changing signal patterns may encode device-relevant location and distance information.Discovering time-invariant and exploiting time-varying features remain open issues.
  • 3) Challenges from deep generative attackers:: GAN-generated signals or packets can mimic victims and increase spoofing success from less than 10% to approximately 80%.MIMO receivers, localization, and dynamically changing controlled imperfections are described as possible remedies.
  • Explainability and assurance: Deep neural networks require further work on explainability and performance assurance because their decision processes and boundaries are difficult to inspect.The survey states that performance cannot be assured without explainability.
  • Continual adaptation: Real-time adaptation requires combining deep feature abstraction with continual and unsupervised learning, but knowledge of this combination remains limited.The survey identifies deep unsupervised learning and explainability as developing trends.
  • 3) Controlled imprinting of verifiable patterns:: Controlled signal or activity-pattern imperfections can provide verifiable identities, but methods remain limited for patterns that adversaries cannot learn.Dynamic pseudorandom changes are proposed to reduce predictability.
  • VI. CONCLUSION: The survey concludes that rogue-device identification needs a multiperspective framework extending beyond signal processing to artificial intelligence and knowledge discovery.This conclusion covers detection from passively collected traffic traces and wireless signal patterns.
Loading 2101.10181v1…