IoT Device and State Identification based on Usage Patterns

In this paper, we explore usage patterns for the identification of IoT devices and their corresponding states. Machine Learning (ML) methods are trained on IoT device traffic patterns to recognize the state that the device is in. Three device states are the focus of this study - Power-up, Idle and Active. Devices are visible and open to cyber attacks from the moment they are powered on. Previous studies have focused primarily on identifying IoT devices which are in the active state. This study advances the research domain by exploring all three states of an IoT device. Eight different ML algorithms are evaluated using three different feature sets extracted from device network traffic, using flow analysis tools - Tranalyzer2, NFStream and Zeek. They are rigorously assessed to accurately identify diverse IoT devices under normal operational conditions over the aforementioned three states. .