IoT Device Classification via Multi-Granularity Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The management of IoT devices in large networks is challenging due to their numerousness and vulnerability to cyber attacks, as they often remain unidentified and cannot defend themselves, posing significant security risks.
Innovation Solution
A network device classification process that monitors network traffic to generate behavior data, classifies devices as IoT or non-IoT, identifies device types, and determines operating states using multi-class and one-class classifiers, with confidence and consistency scoring to ensure accurate and adaptive classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network traffic monitoring is implemented to identify IoT devices, then device identification accuracy is improved, but system complexity increases
Solution Approach 1:
The classification system is divided into multiple independent classifiers, each specialized for specific device types or behaviors. This segmentation allows the system to achieve high identification accuracy for different device categories without requiring a single overly complex classifier, thus managing system complexity through modular architecture.
Solution Approach 2:
The system analyzes network traffic from multiple dimensions including packet size, inter-arrival time, protocol types, and flow patterns. By examining traffic characteristics across these different dimensional parameters, the system achieves accurate device identification without increasing the fundamental complexity of the classification architecture.
2Measurement precision
If multiple classification parameters are used to identify device types, then classification accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary analysis of network traffic parameters as packets arrive, continuously updating device profiles in real-time. By preparing classification data incrementally during traffic monitoring rather than analyzing all parameters simultaneously after collection, the system achieves accurate multi-parameter classification without excessive processing delays.
Solution Approach 2:
The classification system dynamically adjusts its analysis depth and parameter selection based on traffic patterns and device behavior. For well-known device types, the system can use fewer parameters for faster classification, while for unknown or suspicious devices, it performs more comprehensive multi-parameter analysis, thus balancing accuracy and processing time adaptively.
3Reliability
If continuous monitoring of network traffic is performed, then device behavior detection capability is improved, but energy consumption increases
Solution Approach 1:
The system implements periodic sampling of network traffic at strategically selected intervals rather than continuous analysis of every packet. By monitoring traffic flows at appropriate time granularities and sampling rates, the system maintains effective device behavior detection capability while significantly reducing the energy consumption associated with constant full-bandwidth monitoring.
4Measurement precision
If detailed device behavior data is collected at multiple time granularities, then operating state classification accuracy is improved, but data processing complexity increases
Solution Approach 1:
The system segments the analysis of multi-granularity data by processing different time-scale characteristics through specialized classification pathways. Short-term traffic variations are analyzed separately from long-term patterns, allowing accurate operating state classification without requiring a single monolithic complex processing system.
Solution Approach 2:
The system extracts and focuses on the most discriminative temporal features from multi-granularity traffic data, such as burst patterns, periodicity, and anomaly detection markers. By extracting only the critical temporal characteristics needed for state classification rather than processing all raw data at all granularities, the system achieves high accuracy with reduced processing complexity.
Data Source
AI summary
A network device classification process, including: monitoring network traffic of networked devices in a communications network to generate device behaviour data representing network traffic behaviours of the networked devices at different time granularities; processing the device behaviour data to classify a plurality of the networked devices as IoT devices, and others of the networked devices as non-IoT devices; accessing IoT device type data representing predetermined network traffic characteristics of respective known IoT device types; processing the device behaviour data of the IoT devices and the IoT device type data to classify each of the IoT devices as being a corresponding one of the plurality of known IoT device types; and for each of the IoT devices classified as a corresponding known IoT device type, classifying the IoT device as being in a corresponding operating state based on network traffic behaviours of the IoT device at different time granularities.