## 4 Content Analysis and Data Mining
### Group 3: Energy Management and Artificial Intelligence
#### 4.3.3 Care Systems
The following are some features of the proposed system: (1) The statistical mean, the standard deviation, and the total bytes transferred over a window in one second, extracted from the encrypted traffic, are used in this system in order to get the IoT device characteristics and make the transmission control protocol (TCP) vectors unnecessary. (2) Internet traffic is generated from IoT devices, with metadata patterns, such as the packet length to be used in data classification. (3) A one-second window for real-time classification enabling is used. (4) The metadata includes the packet length attributes for characterization. (5) The bias existing among different classifiers is investigated, along with the statistics for characterizing the normal behavior of consumer IoT devices. In this paper, normal behavior is conducted as the device expected function, which is defined by the vendor. (6) The statistics that are used by the solution proposed are calculated in a one-second window from real-world generated traffic. (7) Forest tree-based algorithms are for analyzing the contribution of each device identification statistics. The main contributions are as follows: a solution for privacy-preserving of the IoT devices is provided; low computational consumption of IoT traffic classification encrypted for consumers; the computational performance of the classifier in the process of IoT devices identification is quantified. (8) Statistics that are computed from the packet length metadata over the one-second window is used. (9) Simple operations for statistics are conducted by (9-1) Mean, which is a good scale of the central leaning toward the length; (9-2) The standard deviation, which provides the deviation from the mean. (9-3) The numbers of bytes, device data fluctuations that are transmitted. (10) The median and the mode are used as a central tendency measure in the consumer device's characterization. A prototype is implemented for IoT devices' identification by using a three-stage process: First step, IoT/non-IoT device identification. The second step, specific IoT device identification. Lastly, the third step, IoT device events identification. A binary classifier and a multi-class classifier are used for device type identification and type of device determination, respectively, (types of the devices are motion sensor, camera, etc.). At the final step, a multi-class classifier detects the event, which generates the traffic. The evaluation of the proposed solution is conducted with traffic from two testbeds, in real-world and five traffic classifiers, and the results obtained are validated with hypothesis testing. A packet length of each device is generated and separated; meanwhile, the mean, the median, and the mode in bytes are calculated. The mean calculates and differentiates the devices in the best way above the other statistics. Traffic is collected and analyzed from devices that are off-the-shelf and connected to the testbed. The user interaction with devices can be identified by the proposed solution. Panda library is used in python script in order to calculate the statistics (packet length). It is also used to group the traffic, which is generated by devices into one-second windows. The mean and the packet length standard deviation and the number of the bytes in every group are calculated. The quantification of the contributing process of statistic to each device identification is conducted by the forest tree algorithm. The results from system evaluation showed that: (1) the proposed solution can identify events and IoT devices, by using voice commands to smart assistants. It is also able to differentiate between non-IoT devices and IoT devices. (2) 96% accuracy in the identification of devices is obtained by the random forest algorithm, 99% accuracy in distinguishing between IoT and non-IoT devices, and 99% accuracy in recognizing IoT-based devices events are achieved. (3) Among the five algorithms conducted, the decision tree algorithm has shown the lowest response time in device identification.