Fine-Grained IoT Device Fingerprinting from Passive Network Traffic to Improve Network Security

Abstract

With Internet of Things (IoT) devices becoming more embedded within networks, there is a growing fear that they are contributing to making networks less secure, particularly from the introduction of devices not running their latest software or firmware versions, patched of known vulnerabilities. One solution is to ensure devices automatically and regularly update, and for devices that do not update, implement techniques to identify device versions, alerting users to devices that are not up to date and potentially insecure.

First an IoT lab was set up allowing analysis of IoT device update mechanisms, and then four different novel techniques were proposed to identify device versions from their on-wire traffic, an area not researched before. A significant proportion (36%) of the devices did not receive automatic updates and could be disabled by the user. On average devices also received an update every 3 months. Following this, it was shown that a small number (26%) of devices and their versions could be identified through keywords in HTTP updates. This keywords approach was extended to all unencrypted protocols to obtain device version information, achieving 71% accuracy at identifying device versions for devices that emitted keywords. Next, TLS handshake information was included to cater for encrypted traffic and keyword vectors created, for TF-IDF and Cosine similarity, obtaining 66% average accuracy identifying device versions. The final technique used a Twin Neural Network on flow statistics to cater for the case of devices emitting no keywords, obtaining a best accuracy of 84.38% identifying device version changes.

The author of this thesis argues that although a difficult research problem to solve due to changes between device versions being subtle, granular identification of IoT devices down to version level is possible using a combination of techniques, helping to secure a network, achieving accuracy levels comparable to other works.

Date of Award	13 May 2025
Original language	English
Awarding Institution	University of Bristol
Supervisor	George Oikonomou (Supervisor), Simon M D Armour (Supervisor) & Paul Thomas (Supervisor)