A Pill to Find Them All: IoT Device Behavior Fingerprintin g using Capsule Networks

Aim and Background: The aim of this study is the application of novel deep learning technique of capsule networks for device behavior fingerprinting. Device behavior fingerprinting emerged as an important means to characterize the network behavior of connected devices due to the dynamic nature of smart systems. The study of device behavior fingerprinting strategies gave us an insight into the strengths and weaknesses of different machine learning techniques. It also led us to some research questions that we incorporated in the proposed framework. Firstly, we explored the means to improve the efficiency of passive device fingerprinting techniques. Secondly, we needed to address the privacy concerns that arise from the creation and maintenance of device fingerprints. Objective: To our best knowledge, this is the first time that device for fingerprints had been generated in the form of images. The use of device fingerprints in image form best utilized the object recognition capabilities of capsule networks. Method: We designed a novel method to classify and save the network behaviour of IoT devices that are connected to a network. The proposed model was based on a two-fold innovation of the generation of unique images based on packet parameters of device transmissions, and the design of a model that could carry out efficient and accurate classification of device vendors based on their network behavior. Results and Conclusion: The generation of unique images offered a big advantage of saving the memory of the system. While a packet capture file may take around 150kb or more, the generated images were as small as the order of 2kb. For a smart system made up of thousands of devices, the order of memory space saved would become significant. Furthermore, since the algorithm of image generation could be customized by the network administrators, the images cannot be reverse- engineered by potential attackers, thereby assuring a secure way to save device behavior fingerprints. The developed model has compiled over 500 epochs that roughly translated to 100 minutes and gave the accuracy of the order of 92%. This was the first time that device network behaviour has been translated into an image and tested through classification using capsule networks. The translation of captured packet flows to black and white images not only saved on memory space but also provided a safeguard against reverse engineering by potential attackers. There is a vast scope to further use of this strategy to develop more complex device fingerprinting methods.