ENSIOT: A Stacking Ensemble Learning Approach for IoT Device Identification

In order to resist network attacks on IoT devices, identifying IoT devices is the first step for ensuring device security. The traditional passive method identifies IoT devices by mining the potential relationship between traffic characteristics and devices. However, the form of selected traffic features are too singular without considering device behavioral characteristics and the classifier used is too specific with simple structure in these methods. This paper proposes a stacking ensemble learning approach for IoT device identification, ENSIOT, which fully considering the behavioral characteristics of devices and integrating the advantages of various machine learning methods to achieve efficient identification of IoT devices. Firstly, in the process of traffic processing, our method selects features from activity cycles, port numbers, signalling patterns, and cipher suites. Then, in model integration, many machine learning methods are used as base models to learn features selected, and output preliminary recognition results. Finally, the meta model learns the relationship between label and the recognition results of each base model and outputs the final device identification result. This stacking structure stacks the base models and the meta model to make a classifier with strong identification and generalization ability. Incremental learning is used to improve identification accuracy when traffic pattern changing. Comparative experiments are conducted on two datasets of UNSW and TMA-2021. The experimental results verify the effectiveness of ENSIOT, which achieve the accuracy of over 98% on two dataset and bring a noticeable improvement in terms of both accuracy and macro F1 score.