Passive fingerprinting for wireless devices: A multi-level decision approach

Passive wireless-device fingerprinting - the act of passively and automatically identifying specific types of wireless devices through sequential analysis of wireless traffic - is useful for network monitoring and management. This study presents a novel passive fingerprinting approach for wireless devices, by modeling network traffic with carefully chosen wireless parameters from 802.11 frames, and developing multi-level classification algorithm to perform task of device fingerprinting. Specifically, we systematically evaluate a set of traffic parameters with respect to their stability and discriminability of identifying wireless devices. We employ a distribution-based measurement to obtain signature for each wireless device. We then develop a decision-tree-based multi-level classifier for device fingerprinting. Experimental results show that the parameters of transmission time and inter-arrival time are much more stable for device fingerprinting, and the approach achieves a practically useful level of performance.