Identifying IoT Devices: A Machine Learning Analysis Using Traffic Flow Metadata

Deployment of IoT (Internet of Things) devices in homes, corporate networks and industrial settings continues to rise. The weak security in many such devices leaves them susceptible to targeted attacks. As a result, there is a strong requirement to easily discover and identify such devices, even when they utilize encrypted communications. In this paper, we explore a machine learning (ML) based approach for identification of IoT devices. We contribute to this area of active research by developing a testbed consisting of nine IoT devices and create a labeled dataset which is publicly available. We further investigate eight different ML algorithms with features derived from two different open source network traffic flow analysis tools - Tranalyzer2 and NFStream. Three different flow metadata based feature sets were evaluated to determine their efficacy in identifying the different IoT devices during regular operation. The results show that the Random Forest ML model achieves the highest performance using the Tranalyzer2 feature set with a 99.68% (approximately 100%) F1-Score for identifying IoT devices.