Identifying SH-IoT devices from network traffic characteristics using random forest classifier.

In the cyberspace, device identification has become one of the most important factors in improving security of a network, containing both Internet of Things (IoT) and non-IoT devices. Resource-constraint IoT devices are generally more vulnerable than non-IoT devices, to different kinds of security threats, including Mirai botnet and spoofing attacks. In this paper, a device fingerprinting (DFP) scheme has been proposed based on the analysis of network traffic characteristics. Four statistical features from two device-specific features have been selected using statistical assessment to generate DFP for classification task using a supervised machine learning Random Forest classifier. Experimental results have shown that the proposed DFP scheme is able to classify device type with 99.81% accuracy on the public UNSW dataset, whilst accuracies of 99.50% and 97.10% have been reported for the identification of individual IoT and non-IoT devices, respectively. The proposed DFP scheme has also demonstrated superior performance as compared to other DFP methods in the literature, despite using less number of features and packets for DFP. These signify that the proposed DFP scheme can be used as a network security reinforcement tool in a heterogeneous network environment. [ABSTRACT FROM AUTHOR]