TinyDevID: TinyML-Driven IoT Devices IDentification Using Network Flow Data

IoT device identification is often used as the first line of defense. However, it is challenging due to the acquisition of IoT as a business by the existing vendors of traditional computing devices, making it difficult to adopt identifiers based on IP or MAC addresses. In this paper, we address this problem by using TinyML and a small set of generic flow-based features. In particular, we have designed and developed a novel framework, called TinyDevID, that uses TinyML to achieve device identification in a microcontroller having a very limited memory. TinyDevID employs neural architecture search (NAS) to find best-performing architectures and then builds and converts them to TinyML models, we call them as TinyID models, to be deployed into a microcontroller. We collected about 4.5GB of network traces of three IoT devices in our laboratory setup and extracted 77 flow-based features using a CICFlowMeter. Using ExtraTree classifier, we have selected the top ten features for classification using both multilayer perceptron (MLP) and TinyID models, and compared their performances. The results of our analysis show that the TinyDevID is effective in identifying the IoT devices with an average accuracy of up to 91% for all three devices and a maximum accuracy of 97%, which is slightly higher than MLP models. We have compared the results of TinyDevID with state-of-the-art and show that our work is first to use TinyML models for IoT device identification and it achieves commendable accuracy and false positive rates.