Inferring IoT Device Types from Network Behavior Using Unsupervised Clustering The InternetofThings (IoT) is increasingly becoming a major challenge for network administrators to monitor and manage connected devices and sensors, ranging from smartlights to smokealarms and securitycameras. In addition to new device offerings, manufacturers tend to automatically perform firmware upgrade from their cloud servers to change functionalities of existing devices that are operational in the field. This makes it difficult to retrain device classification models in order to capture legitimate changes dynamically. In this paper, we develop a modular device classification architecture that allows us to dynamically accommodate legitimate changes in network IoT assets, either addition of a new device type or upgrades of existing types, without replacing the entire set of models. Our contributions are twofold: (1) We identify key traffic attributes that can be obtained from flowlevel network telemetry to characterize individual IoT devices. We develop an unsupervised oneclass clustering method for each device to detect its normal network behavior. (2) We tune individual devicespecific clustering models and use them to classify IoT devices in realtime. We enhance our classification by developing methods for automatic conflict resolution and noise filtering. We evaluate the efficacy of our scheme by applying it to traffic traces of ten real IoT devices, and demonstrate its ability to achieve overall accuracy of more than 94%.

The rise of traffic classification in IoT networks: A survey Abstract   With the proliferation of the Internet of Things (IoT), the integration and communication of various objects have become a prevalent practice. The huge growth of IoT devices and different characteristics in the IoT traffic patterns have brought attention to traffic classification methods to address various raised issues in IoT applications. While network traffic classification has been well discussed in a number of surveys and review papers, it is still immature in IoT due to the differences in traffic characteristics in IoT and NonIoT devices. This survey looks at the emerging trends of network traffic classification in IoT and the utilization of traffic classification in its applications. It also compares the legacy of traffic classification methods and presents an overview of traditional models. This paper extends the discussion with a taxonomy of the current network traffic classification within the IoT context. We then expose commercial and realworld use cases of the IoT traffic classification and finally outline open research issues and challenges in this domain.