These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Security experts have demonstrated numerous risks imposed by Internet of
Things (IoT) devices on organizations. Due to the widespread adoption of such
devices, their diversity, standardization obstacles, and inherent mobility,
organizations require an intelligent mechanism capable of automatically
detecting suspicious IoT devices connected to their networks. In particular,
devices not included in a white list of trustworthy IoT device types (allowed
to be used within the organizational premises) should be detected. In this
research, Random Forest, a supervised machine learning algorithm, was applied
to features extracted from network traffic data with the aim of accurately
identifying IoT device types from the white list. To train and evaluate
multi-class classifiers, we collected and manually labeled network traffic data
from 17 distinct IoT devices, representing nine types of IoT devices. Based on
the classification of 20 consecutive sessions and the use of majority rule, IoT
device types that are not on the white list were correctly detected as unknown
in 96% of test cases (on average), and white listed device types were correctly
classified by their actual types in 99% of cases. Some IoT device types were
identified quicker than others (e.g., sockets and thermostats were successfully
detected within five TCP sessions of connecting to the network). Perfect
detection of unauthorized IoT device types was achieved upon analyzing 110
consecutive sessions; perfect classification of white listed types required 346
consecutive sessions, 110 of which resulted in 99.49% accuracy. Further
experiments demonstrated the successful applicability of classifiers trained in
one location and tested on another. In addition, a discussion is provided
regarding the resilience of our machine learning-based IoT white listing method
to adversarial attacks.