# H2O: Secure Interactions in IoT via Behavioral Fingerprinting
## 4 Behavioral Fingerprint for Reliability
### Fingerprint Computation
Indeed, because models for fingerprint must be kept updated in accordance to possible variation in the devices' configuration, a centralized solution would suffer from scalability issues. For this reason, they identify some nodes, i.e. the gateways, inside the IoT that can monitor objects using trained classification models, thus providing scalability to the solution. The training part, instead, is performed by special controller nodes, which in this scenario are considered as part of the ISP. Inside such an architecture, the authors identify a feature vector with 111 dimensions. They tested the performance of their approach obtaining an accuracy of 97% when classifying known devices. With the evolution of the IoT technology, nowadays paradigms such as Internet of Multimedia Things (hereafter, IoMT) have been introduced. In such settings, the devices are assumed to have higher computational capabilities than classical sensors belonging to the Internet of Things. With this in mind, we argue that, in modern general IoT scenarios, we can consider that a combination of Multimedia Things and simple classical smart objects coexists. Therefore, in our H2O network, we consider that the role of controller nodes can be played by the top powerful devices, belonging to \(N_{\textit{{PPU}}}\), which are in charge of training the models by leveraging edge/cloud computing solutions [61]. Whereas, the monitoring nodes can be more common objects with sufficient computational capabilities to execute a trained model. Finally, low-power objects, belonging to \(N_{\textit{{LPU}}}\) or \(N_{\textit{{LPAN}}}\) can leverage delegation strategies to gain reliability information about other nodes. All the controller devices use the same algorithm to build object fingerprints and the same set of features, say \(S\). During the _safe starting phase_, objects with monitoring capabilities interact with their peers to acquire the training set to build the corresponding models. The training set is, hence, used by the controller nodes to fit the model. With that said, in our scenario each monitoring node, say \(n_{i}\), associates and maintains a _profile_ with each of its contacts, say \(n_{j}\) which were added before the _safe starting phase_. In particular, a profile can be defined as follows:  
\[P_{n_{i},n_{j}}=\langle Net_{n_{j}},F_{n_{i},n_{j}}\rangle \tag{1}\]  
Here, \(Net_{n_{j}}\) is a set containing information related to connectivity aspects (such as, the IP address, the MAC address, and so forth), and \(F_{n_{i},n_{j}}\) represents the fingerprint of \(n_{j}\) maintained by \(n_{i}\). In particular, the fingerprint that \(n_{i}\) associate with \(n_{j}\) can be defined as:  
\[F_{n_{i},n_{j}}=\langle m_{n_{i},n_{j}},S\rangle \tag{2}\]where, \(m_{n_{i},n_{j}}\) represents the model built during the _safe starting phase_ according to the data exchanged between \(n_{i}\) and \(n_{j}\). Whereas, the set \(S\) represents the set of features considered in the model. After the _safe starting phase_\(F_{n_{i},n_{j}}\) is used by the monitoring node \(n_{i}\) to assess whether the behavior of \(n_{j}\) is unchanged. This information can be, then, used by the network members to estimate a reliability score for the others. In the next section, we will describe this aspect in more detail.