# IoT Behavioral Monitoring via Network Traffic Analysis

**Authors:** Arunan Sivanathan  
**arXiv:** [2001.10632](https://arxiv.org/abs/2001.10632)  
**Date:** 2020-01-28  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2001.10632v1/

## Key points

- The rise of IoT has led to the deployment of smart devices in homes, enterprises, and cities
- IoT devices pose significant privacy and security challenges not present in traditional IT networks
- Lack of visibility into IoT assets makes it difficult for operators to detect cyber-attacks or ensure proper functioning of each device
- Researchers have developed techniques for profiling network behavioral patterns of IoTs, automating their classification, deducing operating context, and detecting anomalous behavior indicative of cyber-attacks
- Arunan Sivanathan's thesis surveys the IoT ecosystem while reviewing current approaches to vulnerability assessments, intrusion detection, and behavioral monitoring
- Collecting traffic traces and characterizing network behavior of IoT devices via attributes from traffic patterns
- Developing a robust machine learning-based inference engine using these attributes to demonstrate real-time classification of 28 IoT devices with over 99% accuracy
- Developing a modularized unsupervised inference engine that dynamically accommodates new IoT devices or updates to existing ones without requiring system-wide retraining. Experiments show that this model can automatically detect attacks and firmware changes in ten IoT devices with over 94% accuracy.
- Overall, the thesis provides valuable insights into how network traffic analysis can be used to monitor the behavior of IoTs and improve their security posture.

## Summary

The rise of the Internet of Things (IoT) has led to the deployment of a wide range of smart devices in homes, enterprises, and cities. However, these devices also pose significant privacy and security challenges that are not present in traditional IT networks. The lack of visibility into IoT assets makes it difficult for operators to detect cyber-attacks or ensure that each device is functioning properly. To address this issue, researchers have developed techniques for profiling the network behavioral patterns of IoTs, automating their classification, deducing their operating context, and detecting anomalous behavior indicative of cyber-attacks. In this thesis by Arunan Sivanathan, the author surveys the IoT ecosystem while reviewing current approaches to vulnerability assessments, intrusion detection, and behavioral monitoring. The first contribution involves collecting traffic traces and characterizing the network behavior of IoT devices via attributes from traffic patterns. A robust machine learning-based inference engine is then developed using these attributes to demonstrate real-time classification of 28 IoT devices with over 99% accuracy. The second contribution enhances classification by reducing the cost of attribute extraction while identifying IoT device states. Prototype implementation and evaluation demonstrate the ability of supervised machine learning methods to detect behavioral changes for five IoT devices. The third and final contribution develops a modularized unsupervised inference engine that dynamically accommodates new IoT devices or updates to existing ones without requiring system-wide retraining. Experiments show that this model can automatically detect attacks and firmware changes in ten IoT devices with over 94% accuracy. Overall, this thesis provides valuable insights into how network traffic analysis can be used to monitor the behavior of IoTs and improve their security posture. By automating device classification and detecting anomalous behavior in real-time, operators can better protect their smart environments from potential cyber threats.