Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices
Authors: Dilawer Ahmed (North Carolina State University), Anupam Das (North Carolina State University), Fareed Zaffar (Lahore University of Management Sciences (LUMS))
Volume: 2022
Issue: 2
Pages: 578–600
DOI: https://doi.org/10.2478/popets-2022-0057
Abstract: In recent years, we have seen rapid growth in the use and adoption of Internet of Things (IoT) devices. However, some IoT devices are sensitive in nature, and simply knowing what devices a user owns can have security and privacy implications. Researchers have, there- fore, looked at fingerprinting IoT devices and their activities from encrypted network traffic. In this paper, we analyze the feasibility of fingerprinting IoT devices and evaluate the robustness of such fingerprinting approach across multiple independent datasets — collected under different settings. We show that not only is it possible to effectively fingerprint 188 IoT devices (with over 97% accuracy), but also to do so even with multiple instances of the same make-and-model device. We also analyze the extent to which temporal, spatial and data-collection-methodology differences impact fingerprinting accuracy. Our analysis sheds light on features that are more robust against varying conditions. Lastly, we comprehensively analyze the performance of our approach under an open-world setting and propose ways in which an adversary can enhance their odds of inferring additional information about unseen devices (e.g., similar devices manufactured by the same company).
Keywords: Device fingerprint, generalizibility, Internet of Things
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 license.
