LAUSR

Traffic management is becoming increasingly complex due to the increasing diversity of IoT platforms and protocols supported by heterogeneous devices. Recently, device fingerprinting techniques for automatic device recognition leveraging on domain knowledge in TCP/IP and AI techniques are becoming more prevalent. However, existing machine-learning (ML) models have trained  HTTP  and  TCP  flows that are not correctly weighted. Besides, these models are trained with algorithms that can extrapolate temporal information; thus, they are not temporal aware. This paper presents a two-level machine learning pipeline ( IoT Sense ) for IoT device recognition, using (1) SVM and Decision Tree to model the spatial behaviors and (2) RNN to model the device-to-device temporal actions. The ground truth of the work is that the communication behaviors of IoT sensors, actuators, and devices are more deterministic using control plane traffic instead of data plane traffic. IoT devices commonly rely on  SSDP ,  IoTivity ,  AllJoyn  to discover neighbors and exchange devices' information. These device-to-device  hello(s)  are more predictable than traffic patterns induced by random usage behaviors. Deep learning (DL) models trained on raw traffic; without adding custom weightage to control packets; can be biased towards user-induced behaviors that eventually over-fit the resulting model.  IoT Sense  classify based on the connectivity pattern among IoT nodes using control plane traffic that includes discovery, handshake, and session establishment flows.  IoT Sense  is platform-agnostic since it operates on connection properties (TCPIP/layer 3) instead of protocols (like CoAP, MQTT). The experimental results show that the proposed context-aware model achieved accuracy up to 0.956 precision score with a 0.0957 recall rate in IoT devices classification.