Automated Behavior Identification of Home Security Camera Traffic

With the widespread use of IoT devices in the market, home security cameras (HSCs) have become one of the most commonly used devices. However, the security risks of these devices, such as cyber attacks and privacy breaches, still remain a concern. To analyze the behavior of HSC devices, researchers and intruders often rely on traffic data. However, identifying the behavioral traffic of HSC devices is a challenging task because it is difficult to distinguish it from dynamic video traffic during transmission. We propose a new approach to solve this problem by analyzing the features of unidirectional packets present in non-TLS network traffic. Additionally, we found that manually labeling device behavior traffic data is time-consuming and often inaccurate. We introduce a two-factor automatic behavior labeling approach based on reverse traffic and operation logs to address this concern. Finally, we test the performance of multiple classifiers on two datasets: a real-world dataset and the IMC 2019 payload public dataset. Our experiments show that the proposed framework is able to extract and identify behavioral traffic automatically. The CNN-based classifier can accurately identify fine-grained behavioral traffic of HSC devices based on unidirectional upload traffic features. This study has implications for improving security threat awareness of IoT products and anomalous behavior detection of HSC devices.