Device Identification and Anomaly Detection in IoT Environments

As the Internet of Things (IoT) landscape continues to expand, a diverse range of devices with various functionalities is being integrated into the IoT ecosystem. When traditional systems, which involve human interaction, are replaced by devices, it becomes crucial to upgrade the conventional authorization and authentication mechanisms. Traditional approaches for device identification and anomaly detection often fail to address the dynamic behaviors of IoT devices due to the highly heterogeneous nature of the IoT environment. To address these challenges, this article proposes a novel and lightweight integrated model for simultaneous IoT device identification and anomaly detection. The proposed approach leverages both packet-based and flow-based feature extraction techniques to extract a diverse and significant set of features, which are crucial for robust anomaly detection and device classification. This novel combined feature set incorporates a wide range of attributes from various domains, including HTTPS-related features, handshake information, and user agent strings, specifically extracted for IoT device identification. In addition, the feature set includes specialized attributes for anomaly detection, such as stream, channel, and jitter metrics, which are calculated over different time intervals to enhance the model’s anomaly detection capabilities. Experimental analysis, conducted using real network traffic data from state-of-the-art datasets, demonstrates the model’s efficiency and scalability, which makes the model well-suited for real-time IoT threat detection and device management in resource-constrained environments.