IoT Device Identification Using Passive Network Traffic Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device identification methods for IoT devices are unreliable as they interrupt services and have low reliability due to the need for devices to report information for identification, making them vulnerable to DDoS attacks and counterfeiting.
Innovation Solution
A method that determines device types based on network traffic features using data packet amounts collected within periodicities, without requiring the device to report identifying information, utilizing a device identification model to analyze data amount distribution and frequency-domain features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If device identification is performed by sending protocol probe packets to obtain banner information, then device type can be determined, but the device service may be interrupted and reliability is low
Solution Approach 1:
The patent extracts only the necessary identification features from the protocol probe packet interaction process. Instead of requiring the device to report its banner information (which interrupts service), the management device extracts device type information from the device's responses to probe packets, specifically analyzing the protocol type and version information returned by the device during normal operation.
Solution Approach 2:
The patent introduces protocol probe packets as an intermediary mechanism. The management device sends probe packets to the device, and the device responds with protocol information that reveals its type without requiring the device to actively report or interrupt its service. This intermediary approach allows passive identification while maintaining service continuity.
2Measurement precision
If devices report information for identification, then device type can be determined, but devices become vulnerable to DDoS attacks and counterfeiting
Solution Approach 1:
The patent inverts the traditional identification approach. Instead of the device actively reporting its information (which creates vulnerability), the management device actively probes the device with protocol packets and derives identification information from the device's protocol responses. This reversal makes the device passive in the identification process, reducing its exposure to attacks.
Solution Approach 2:
The patent leverages the device's own protocol implementation as the identification source. The device naturally responds to protocol packets according to its type and version, and these self-generated responses contain the identification information. No additional reporting mechanism is needed, and the device's normal protocol behavior serves the identification purpose without creating security vulnerabilities.
3Measurement precision
If banner information is used for identification, then device type can be determined, but the identification process is complex and time-consuming
Solution Approach 1:
The patent extracts only the essential identification elements from the protocol interaction - specifically the protocol type and version information contained in the device's response to probe packets. This extracted information is sufficient for device type determination and eliminates the need for complex banner analysis or multiple information gathering steps.
Solution Approach 2:
The patent performs preliminary action by sending protocol probe packets that are designed to elicit specific responses containing identification information. The probe packets are pre-configured to query protocol type and version, and the device's response directly provides the needed identification data without requiring subsequent analysis or additional queries.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A device identification method, apparatus, and system are provided. A management device or a collection device first determines a network traffic feature of a to-be-identified device based on a first dataset. The first dataset includes a plurality of pieces of first data, and each piece of first data includes a data amount of a data packet that is of the to-be-identified device and that is collected within one first periodicity. Then, the management device or the collection device determines a device type of the to-be-identified device based on a device identification model and the network traffic feature of the to-be-identified device. In a device identification process, the to-be-identified device does not need to report information used to identify the to-be-identified device. Therefore, a service run on the to-be-identified device is not interrupted, and reliability of running the service by the to-be-identified device is high.