GoNP: Graph of Network Patterns for Device Identification using UDP Application Layer Protocols

Analyzing network traffic and identifying unique IoT devices is important to secure and safeguard the IoT network. Machine Learning models have been leveraged to train classifiers to identify network devices based on the network packets. However, past approaches have often involved either MAC address, IP address, or both when identifying IoT devices in a network. These approaches do not consider the challenge of IP and MAC spoofing when developing their classifier models. This research introduces GoNP, a graph-based approach for extracting network traffic patterns and matching them to a corresponding IoT device. In contrast to previous approaches, our approach does not consider IP and MAC addresses during device identification as these can be easily spoofed. We have designed and developed a graph-based device identification model that achieves IoT device identification accuracy of upto 100%. We have evaluated our approach against past approaches that leveraged machine learning classifiers for device identification, and our model performed consistently better when the IP and MAC addresses of network devices are spoofed.