| With the rapid development of Internet of Things(IoT)technology,IoT has become an integral part of the new generation of information technology.In order to effectively discover and identify the IoT devices,and then efficiently conduct the security management in cyberspace,this paper carries out research work on IoT device identification.Currently,there are problems of mixed device protocols,low device discovery and recognition rates in IoT identification.This paper is based on the passive detection of IoT devices,and analyses the plaintext traffic and WiFi traffic of devices.The research is carried out on the features of plaintext traffic to improve the device recognition rate by mining the traffic protocol fields and carving out the feature dimensions;the research is carried out on the features of WiFi traffic to extract the ciphertext traffic features,identify the device model through an improved decision tree CART algorithm,identify the device type through feature enhancement and Swin Transformer algorithm.A prototype IoT device identification system is designed and implemented,and the validity of the proposed model is demonstrated through detection examples in different scenarios.The main research in this paper is as follows:(1)A plaintext traffic-based IoT device identification model is proposed.By analytically mining the plaintext traffic features and introducing the internal field information of protocols such as EAPOL,DNS and IP to broaden the dimension of IoT device features.As a result,the accuracy of IoT device identification is from 76.0% to 86.8%,which achieves further improvements in plaintext traffic recognition accuracy.(2)A WiFi traffic-based IoT device identification model is proposed.On the one hand,the device is identified by selecting the fields of frame length,frame arrival time,duration and frame sequence number in the WiFi traffic as traffic features for device model,using a decision tree CART algorithm based on parameter optimization.On the other hand,an image representation of WiFi traffic,Cutout feature augmentation,is used as the traffic feature for device type,and the Swin Transformer algorithm is used to identify the device.Model identification as well as type identification of IoT devices in a WiFi environment is achieved by this model.(3)A prototype IoT device identification system was designed and implemented,combining the plaintext traffic-based IoT device identification model and the WiFi traffic-based IoT device identification model,and a traffic collection visualization tool was designed.The detection example showed that the model recognition rate based on plaintext traffic was 86.8%,the model recognition rate based on WiFi traffic was 91.3%,and the type recognition rate was98.0%. |
