# H2O: Secure Interactions in IoT via Behavioral Fingerprinting
## 4 Behavioral Fingerprint for Reliability
### Fingerprint Computation  
In this section we deep dive in the description of the behavioral fingerprint computation. Behavioral fingerprint is a very timely research subjects and several investigations are already available in the scientific literature [8; 21; 22; 23]. Most of the existing works deal with the problem of identifying general features that can be applied to any existing IoT device, but, such that, together can unequivocally represent a single specific object. Generally, two categories of fingerprinting strategy are adopted, namely: _(i)_ non-behavioral fingerprinting and _(ii)_ behavioral fingerprinting [53]. The first category of approaches leverages features related to physical and link layer characteristics [56; 57]. For instance, the authors of [56] extracted 19 features from the 802.11 probe fields. The selected features have been identified by observing which variations are typically recorded when the devices are under attack or involved in anomalous situations in their environment. In particular, this approach works as follows. In the first phase, wireless network traffic from devices is collected, and probe request frames are filtered out to extract the data-link layer header from the frames. After removing the outliers, a set of unique, tamper-proof, non-reproducible features that can be used for the device type fingerprinting are chosen. Signature has been used to generate the profile for each device type. Finally, these profiles are then matched in the verification phase through some similarity measures to establish if the device type is registered in the system. In the approach described in [57], instead, the authors focused on a different set of features related to clock characteristics and TCP timestamp. In particular, this approach is based on thirteen clock characteristics to remotely identify different IoT device models of various manufacturers. The authors define a set of machine learning features related to how monotonic timestamp clocks generate TCP timestamp values, and they use these features to detect model specific characteristics. Moreover, they compare different machine learning algorithms and identified Random Forest as the best classifier in this setting. In general,  
Figure 3: The steps of our approach for a human-to-human interaction. non-behavioral fingerprinting can be successfully applied if the considered features can be adapted to the characteristic of the network, in which the object is located. In this way, particular situations in the network, like congestion or bottlenecks, do not impact on the fingerprinting model. Behavioral fingerprinting, instead, focuses on more application-level features to model objects' traits. Therefore, instead of focusing only on the physical and link layers information, the approaches belonging to this category go further in the characteristic of the packets generated by extracting information. Among these characteristics there are: protocols, request-response sequences and any periodicity in specific typology of packets along with their sizes [58; 59; 60]. In particular, the approach of [58] focuses on TCP/IP connections and extracts features from them (such as, time-to-live, byte sent and received, etc.). With these features, the authors trained a Random Forest model and were able to distinguish the monitored objects from external ones with a precision of 97%. Similarly, the approach described in [59] focuses on different typologies of traffic an object can generate, for instance queries to DNSs, packets related to user activity on known application (e.g., google home, maps, etc. ), and interaction with known service. With these information, the authors adopted a deep learning solution based on LSTM-CNN model. This approach reaches a best accuracy value of 80.1%. Very close to our application scenario is the solution described in [60]. In this paper, the authors describe a distributed solution for behavioral IoT fingerprinting.