A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets

Abstract

In the current network-based computing world, where the number of interconnected devices grows exponentially, their diversity, malfunctions, and cybersecurity threats are increasing at the same rate. To guarantee the correct functioning and performance of novel environments such as Smart Cities, Industry 4.0, or crowdsensing, it is crucial to identify the capabilities of their devices (e.g., sensors, actuators) and detect potential misbehavior that may arise due to cyberattacks, system faults, or misconfigurations. With this goal in mind, a promising research field emerged focusing on creating and managing fingerprints that model the behavior of both the device actions and its components. The article at hand studies the recent growth of the device behavior fingerprinting field in terms of application scenarios, behavioral sources, and processing and evaluation techniques. First, it performs a comprehensive review of the device types, behavioral data, and processing and evaluation techniques used by the most recent and representative research works dealing with two major scenarios: device identification and device misbehavior detection. After that, each work is deeply analyzed and compared, emphasizing its characteristics, advantages, and limitations. This article also provides researchers with a review of the most relevant characteristics of existing datasets as most of the novel processing techniques are based on machine learning and deep learning. Finally, it studies the evolution of these two scenarios in recent years, providing lessons learned, current trends, and future research challenges to guide new solutions in the area.

References in corpus (28)

• XGBoost: A Scalable Tree Boosting System
• UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction
• Network Function Virtualization: State-of-the-art and Research Challenges
• LSTM Fully Convolutional Networks for Time Series Classification
• N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders
• A Survey on Distributed Machine Learning
• IoT Sentinel: Automated Device-Type Identification for Security Enforcement in IoT
• Federated Machine Learning: Concept and Applications
• Unrolled Generative Adversarial Networks
• Deep Reinforcement Learning that Matters
• Peek-a-Boo: I see your smart home activities, even encrypted!
• Detection of Unauthorized IoT Devices Using Machine Learning Techniques
• Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic
• Keeping the Smart Home Private with Smart(er) IoT Traffic Shaping
• MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
• IoT Inspector: Crowdsourcing Labeled Network Traffic from Smart Home Devices at Scale
• Clear as MUD: Generating, Validating and Applying IoT Behaviorial Profiles (Technical Report)
• IoTSense: Behavioral Fingerprinting of IoT Devices
• Sequence Aggregation Rules for Anomaly Detection in Computer Network Traffic
• CIoTA: Collaborative IoT Anomaly Detection via Blockchain
• Closing the Blinds: Four Strategies for Protecting Smart Home Privacy from Network Observers
• AuthCODE: A Privacy-preserving and Multi-device Continuous Authentication Architecture based on Machine and Deep Learning
• Integrated NFV/SDN Architectures: A Systematic Literature Review
• A Survey: Embedded Systems Supporting By Different Operating Systems
• RADS: Real-time Anomaly Detection System for Cloud Data Centres
• Towards a secure behavior modeling for IoT networks using Blockchain
• Tracking System Behaviour from Resource Usage Data
• Host-based anomaly detection using Eigentraces feature extraction and one-class classification on system call trace data

Cited by in corpus (11)

• Fedstellar: A Platform for Decentralized Federated Learning
• Physical Layer-Based Device Fingerprinting for Wireless Security: From Theory to Practice
• Studying the Robustness of Anti-adversarial Federated Learning Models Detecting Cyberattacks in IoT Spectrum Sensors
• RL and Fingerprinting to Select Moving Target Defense Mechanisms for Zero-day Attacks in IoT
• A methodology to identify identical single-board computers based on hardware behavior fingerprinting
• Federated Learning for Malware Detection in IoT Devices
• A Lightweight Moving Target Defense Framework for Multi-purpose Malware Affecting IoT Devices
• LwHBench: A low-level hardware component benchmark and dataset for Single Board Computers
• CyberSpec: Intelligent Behavioral Fingerprinting to Detect Attacks on Crowdsensing Spectrum Sensors
• Robust Federated Learning for execution time-based device model identification under label-flipping attack
• A Classification-by-Retrieval Framework for Few-Shot Anomaly Detection to Detect API Injection Attacks