Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations

Ash Andrews; George Oikonomou; Simon M D Armour; Paul Thomas; Thomas Cattermole

doi:10.1109/WF-IoT58464.2023.10539470

Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations

Ash Andrews, George Oikonomou, Simon M D Armour, Paul Thomas, Thomas Cattermole

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

1 Citation (Scopus)

19 Downloads (Pure)

Abstract

Internet of Things (IoT) devices are becoming more widespread in networks and can give malicious actors new vectors to compromise networks. Of particular concern are devices running out-of-date firmware versions with known vulnerabilities. Securing real-world IoT networks therefore relies on knowing what devices are on a network and knowing what specific firmware versions they are running. At present, though, commercial solutions that include IoT device identification are not reliable at this level of granularity, and the academic literature has largely ignored the problem. In this paper, we highlight the shortcomings present in current IoT device identification and use these observations to develop a set of lab requirements. We then present our own lab setup for providing reliable real-world IoT device identification that meets this set of requirements. Building on this work, we develop a schema for documenting device versions and event histories that accompany network packet traces as metadata.

Original language	English
Title of host publication	2023 IEEE World Forum on Internet of Things
Subtitle of host publication	The Blue Planet: A Marriage of Sea and Space, WF-IoT 2023
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Number of pages	6
ISBN (Electronic)	979-8-3503-1161-7
ISBN (Print)	979-8-3503-1162-4
DOIs	https://doi.org/10.1109/WF-IoT58464.2023.10539470
Publication status	Published - 30 May 2024
Event	IEEE 9th World Forum on Internet of Things - Aveiro Congress Center, Aveiro, Portugal Duration: 12 Oct 2023 → 27 Oct 2023 https://wfiot2023.iot.ieee.org/

Publication series

Name	IEEE World Forum on Internet of Things (WF-IoT)
Publisher	IEEE
ISSN (Print)	2769-4003
ISSN (Electronic)	2768-1734

Conference

Conference	IEEE 9th World Forum on Internet of Things
Abbreviated title	WFIoT 2023
Country/Territory	Portugal
City	Aveiro
Period	12/10/23 → 27/10/23
Other	The 9th IEEE World Forum on Internet of Things (IEEE WFIoT2023) is the premier event of the IEEE IoT Technical Community, a multiple Society initiative aggregating the wide expertise inherent to the IoT domain.
Internet address	https://wfiot2023.iot.ieee.org/

Bibliographical note

Publisher Copyright:
© 2023 IEEE.

Access to Document

10.1109/WF-IoT58464.2023.10539470

Full-text PDF (accepted manuscript) Accepted author manuscript, 1.05 MBLicence: Unspecified

Handle.net

Persistent link

Cite this

Andrews, A., Oikonomou, G., Armour, S. M. D., Thomas, P., & Cattermole, T. (2024). Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations. In 2023 IEEE World Forum on Internet of Things: The Blue Planet: A Marriage of Sea and Space, WF-IoT 2023 (IEEE World Forum on Internet of Things (WF-IoT)). Institute of Electrical and Electronics Engineers (IEEE). https://doi.org/10.1109/WF-IoT58464.2023.10539470

Andrews, Ash ; Oikonomou, George ; Armour, Simon M D et al. / Reliable Identification of IoT Devices from Passive Network Traffic Analysis : Requirements and Recommendations. 2023 IEEE World Forum on Internet of Things: The Blue Planet: A Marriage of Sea and Space, WF-IoT 2023. Institute of Electrical and Electronics Engineers (IEEE), 2024. (IEEE World Forum on Internet of Things (WF-IoT)).

@inproceedings{70065d42dfe144fd9816565148362e66,

title = "Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations",

abstract = "Internet of Things (IoT) devices are becoming more widespread in networks and can give malicious actors new vectors to compromise networks. Of particular concern are devices running out-of-date firmware versions with known vulnerabilities. Securing real-world IoT networks therefore relies on knowing what devices are on a network and knowing what specific firmware versions they are running. At present, though, commercial solutions that include IoT device identification are not reliable at this level of granularity, and the academic literature has largely ignored the problem. In this paper, we highlight the shortcomings present in current IoT device identification and use these observations to develop a set of lab requirements. We then present our own lab setup for providing reliable real-world IoT device identification that meets this set of requirements. Building on this work, we develop a schema for documenting device versions and event histories that accompany network packet traces as metadata.",

author = "Ash Andrews and George Oikonomou and Armour, {Simon M D} and Paul Thomas and Thomas Cattermole",

note = "Publisher Copyright: {\textcopyright} 2023 IEEE.; IEEE 9th World Forum on Internet of Things, WFIoT 2023 ; Conference date: 12-10-2023 Through 27-10-2023",

year = "2024",

month = may,

day = "30",

doi = "10.1109/WF-IoT58464.2023.10539470",

language = "English",

isbn = "979-8-3503-1162-4",

series = "IEEE World Forum on Internet of Things (WF-IoT)",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

booktitle = "2023 IEEE World Forum on Internet of Things",

address = "United States",

url = "https://wfiot2023.iot.ieee.org/",

}

Andrews, A , Oikonomou, G , Armour, SMD, Thomas, P & Cattermole, T 2024, Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations. in 2023 IEEE World Forum on Internet of Things: The Blue Planet: A Marriage of Sea and Space, WF-IoT 2023. IEEE World Forum on Internet of Things (WF-IoT), Institute of Electrical and Electronics Engineers (IEEE), IEEE 9th World Forum on Internet of Things, Aveiro, Portugal, 12/10/23. https://doi.org/10.1109/WF-IoT58464.2023.10539470

Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations. / Andrews, Ash ; Oikonomou, George ; Armour, Simon M D et al.
2023 IEEE World Forum on Internet of Things: The Blue Planet: A Marriage of Sea and Space, WF-IoT 2023. Institute of Electrical and Electronics Engineers (IEEE), 2024. (IEEE World Forum on Internet of Things (WF-IoT)).

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

TY - GEN

T1 - Reliable Identification of IoT Devices from Passive Network Traffic Analysis

T2 - IEEE 9th World Forum on Internet of Things

AU - Andrews, Ash

AU - Oikonomou, George

AU - Armour, Simon M D

AU - Thomas, Paul

AU - Cattermole, Thomas

PY - 2024/5/30

Y1 - 2024/5/30

N2 - Internet of Things (IoT) devices are becoming more widespread in networks and can give malicious actors new vectors to compromise networks. Of particular concern are devices running out-of-date firmware versions with known vulnerabilities. Securing real-world IoT networks therefore relies on knowing what devices are on a network and knowing what specific firmware versions they are running. At present, though, commercial solutions that include IoT device identification are not reliable at this level of granularity, and the academic literature has largely ignored the problem. In this paper, we highlight the shortcomings present in current IoT device identification and use these observations to develop a set of lab requirements. We then present our own lab setup for providing reliable real-world IoT device identification that meets this set of requirements. Building on this work, we develop a schema for documenting device versions and event histories that accompany network packet traces as metadata.

AB - Internet of Things (IoT) devices are becoming more widespread in networks and can give malicious actors new vectors to compromise networks. Of particular concern are devices running out-of-date firmware versions with known vulnerabilities. Securing real-world IoT networks therefore relies on knowing what devices are on a network and knowing what specific firmware versions they are running. At present, though, commercial solutions that include IoT device identification are not reliable at this level of granularity, and the academic literature has largely ignored the problem. In this paper, we highlight the shortcomings present in current IoT device identification and use these observations to develop a set of lab requirements. We then present our own lab setup for providing reliable real-world IoT device identification that meets this set of requirements. Building on this work, we develop a schema for documenting device versions and event histories that accompany network packet traces as metadata.

UR - https://wfiot2023.iot.ieee.org/

U2 - 10.1109/WF-IoT58464.2023.10539470

DO - 10.1109/WF-IoT58464.2023.10539470

M3 - Conference Contribution (Conference Proceeding)

SN - 979-8-3503-1162-4

T3 - IEEE World Forum on Internet of Things (WF-IoT)

BT - 2023 IEEE World Forum on Internet of Things

PB - Institute of Electrical and Electronics Engineers (IEEE)

Y2 - 12 October 2023 through 27 October 2023

ER -

Andrews A , Oikonomou G , Armour SMD, Thomas P, Cattermole T. Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations. In 2023 IEEE World Forum on Internet of Things: The Blue Planet: A Marriage of Sea and Space, WF-IoT 2023. Institute of Electrical and Electronics Engineers (IEEE). 2024. (IEEE World Forum on Internet of Things (WF-IoT)). doi: 10.1109/WF-IoT58464.2023.10539470

Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations

Abstract

Publication series

Conference

Bibliographical note

Access to Document

Handle.net

Other files and links

Fingerprint

Cite this