Payload State Prediction Based on Real-Time IoT Network Traffic Using Hierarchical Clustering with Iterative Optimization

IoT (Internet of Things) networks are vulnerable to network viruses and botnets, while facing serious network security issues. The prediction of payload states in IoT networks can detect network attacks and achieve early warning and rapid response to prevent potential threats. Due to the instability and packet loss of communications between victim network nodes, the constructed protocol state machines of existing state prediction schemes are inaccurate. In this paper, we propose a network payload predictor called IoTGuard, which can predict the payload states in IoT networks based on real-time IoT network traffic. The steps of IoTGuard are briefly as follows: Firstly, the application-layer payloads between different nodes are extracted through a module of network payload separation. Secondly, the classification of payload state within network flows is obtained via a payload extraction module. Finally, the predictor of payload state in a network is trained on a payload set, and these payloads have state labels. Experimental results on the Mozi botnet dataset show that IoTGuard can predict the state of payloads in IoT networks more accurately while ensuring execution efficiency. IoTGuard achieves an accuracy of 86% in network payload prediction, which is 8% higher than the state-of-the-art method NetZob, and the training time is reduced by 52.8%.