{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,7]],"date-time":"2026-03-07T18:04:41Z","timestamp":1772906681209,"version":"3.50.1"},"reference-count":30,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2021,4,10]],"date-time":"2021-04-10T00:00:00Z","timestamp":1618012800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Horizon 2020","award":["856602"],"award-info":[{"award-number":["856602"]}]},{"name":"Horizon 2020","award":["688203"],"award-info":[{"award-number":["688203"]}]},{"DOI":"10.13039\/501100002341","name":"Academy of Finland","doi-asserted-by":"publisher","award":["296096"],"award-info":[{"award-number":["296096"]}],"id":[{"id":"10.13039\/501100002341","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>In an Internet of Things (IoT) environment, a large volume of potentially confidential data might be leaked from sensors installed everywhere. To ensure the authenticity of such sensitive data, it is important to initially verify the source of data and its identity. Practically, IoT device identification is the primary step toward a secure IoT system. An appropriate device identification approach can counteract malicious activities such as sending false data that trigger irreparable security issues in vital or emergency situations. Recent research indicates that primary identity metrics such as Internet Protocol (IP) or Media Access Control (MAC) addresses are insufficient due to their instability or easy accessibility. Thus, to identify an IoT device, analysis of the header information of packets by the sensors is of imperative consideration. This paper proposes a combination of sensor measurement and statistical feature sets in addition to a header feature set using a classification-based device identification framework. Various machine Learning algorithms have been adopted to identify different combinations of these feature sets to provide enhanced security in IoT devices. The proposed method has been evaluated through normal and under-attack circumstances by collecting real-time data from IoT devices connected in a lab setting to show the system robustness.<\/jats:p>","DOI":"10.3390\/s21082660","type":"journal-article","created":{"date-parts":[[2021,4,12]],"date-time":"2021-04-12T05:52:00Z","timestamp":1618206720000},"page":"2660","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":37,"title":["Automated IoT Device Identification Based on Full Packet Information Using Real-Time Network Traffic"],"prefix":"10.3390","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2111-4934","authenticated-orcid":false,"given":"Narges","family":"Yousefnezhad","sequence":"first","affiliation":[{"name":"Department of Computer Science, Aalto University, Tietotekniikantalo, Konemiehentie 2, 02150 Espoo, Finland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Avleen","family":"Malhi","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Aalto University, Tietotekniikantalo, Konemiehentie 2, 02150 Espoo, Finland"},{"name":"Department of Computing and Informatics, Bournemouth University, Fern Barrow, Poole, Dorest BH12 5BB, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8078-5172","authenticated-orcid":false,"given":"Kary","family":"Fr\u00e4mling","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Aalto University, Tietotekniikantalo, Konemiehentie 2, 02150 Espoo, Finland"},{"name":"Department of Computing Science, Ume\u00e5 University, Mit-Huset, 901 87 Ume\u00e5, Sweden"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2021,4,10]]},"reference":[{"key":"ref_1","unstructured":"(2020, June 04). Gratner Newsroom. Available online: https:\/\/gartner.com\/en\/newsroom\/id\/283971."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1109\/MC.2017.62","article-title":"Botnets and internet of things security","volume":"50","author":"Bertino","year":"2017","journal-title":"Computer"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Shah, T., and Venkatesan, S. (August, January 31). Authentication of IoT device and IoT server using secure vaults. Proceedings of the 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications\/12th IEEE International Conference On Big Data Science And Engineering (TrustCom\/BigDataSE), New York, NY, USA.","DOI":"10.1109\/TrustCom\/BigDataSE.2018.00117"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Aksoy, A., and Gunes, M.H. (2019, January 20\u201324). Automated IoT Device Identification using Network Traffic. Proceedings of the 2019 IEEE International Conference on Communications, ICC 2019, Shanghai, China.","DOI":"10.1109\/ICC.2019.8761559"},{"key":"ref_5","unstructured":"Raval, M., and Sunkireddy, R. (2021, April 08). Hardware Root of Trust on IoT Gateway. Available online: https:\/\/www.techdesignforums.com\/practice\/technique\/hardware-roots-of-trust-for-iot-security\/."},{"key":"ref_6","unstructured":"Gu, T., Kotagiri, R., and Liu, H. (2017, January 7\u201310). Authentication and Access Control for Open Messaging Interface Standard. Proceedings of the 14th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, Melbourne, Australia."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Li, B., Gunes, M.H., Bebis, G., and Springer, J. (2013, January 18). A supervised machine learning approach to classify host roles on line using sflow. Proceedings of the First Edition Workshop on High Performance and Programmable Networking, New York, NY, USA.","DOI":"10.1145\/2465839.2465847"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Yousefnezhad, N., Madhikermi, M., and Fr\u00e4mling, K. (2018, January 18\u201320). MeDI: Measurement-based Device Identification Framework for Internet of Things. Proceedings of the 16th IEEE International Conference on Industrial Informatics, INDIN 2018, Porto, Portugal.","DOI":"10.1109\/INDIN.2018.8472080"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"353","DOI":"10.1007\/s11277-009-9697-0","article-title":"Identities in the future internet of things","volume":"49","author":"Sarma","year":"2009","journal-title":"Wirel. Pers. Commun."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Mahalle, P., Babar, S., Prasad, N.R., and Prasad, R. (2010). Identity management framework towards internet of things (IoT): Roadmap and key challenges. International Conference on Network Security and Applications, Springer.","DOI":"10.1007\/978-3-642-14478-3_43"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Miettinen, M., Heuser, S., Kronz, W., Sadeghi, A., and Asokan, N. (2014, January 3\u20136). ConXsense: Automated context classification for context-aware access control. Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS \u201914, Kyoto, Japan.","DOI":"10.1145\/2590296.2590337"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"414","DOI":"10.1109\/SURV.2013.042313.00197","article-title":"Context Aware Computing for The Internet of Things: A Survey","volume":"16","author":"Perera","year":"2014","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Kohno, T., Broido, A., and Claffy, K.C. (2005, January 8\u201311). Remote Physical Device Fingerprinting. Proceedings of the 2005 IEEE Symposium on Security and Privacy (S&P 2005), Oakland, CA, USA.","DOI":"10.1109\/SP.2005.18"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Arackaparambil, C., Bratus, S., Shubina, A., and Kotz, D. (2010, January 22\u201324). On the reliability of wireless fingerprinting using clock skews. Proceedings of the Third ACM Conference on Wireless Network Security, WISEC 2010, Hoboken, NJ, USA.","DOI":"10.1145\/1741866.1741894"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"449","DOI":"10.1109\/TMC.2009.145","article-title":"On Fast and Accurate Detection of Unauthorized Wireless Access Points Using Clock Skews","volume":"9","author":"Jana","year":"2010","journal-title":"IEEE Trans. Mob. Comput."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"150","DOI":"10.1016\/j.ijcip.2013.08.003","article-title":"Flow whitelisting in SCADA networks","volume":"6","author":"Barbosa","year":"2013","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"519","DOI":"10.1109\/TDSC.2014.2369033","article-title":"GTID: A technique for physical device and device type fingerprinting","volume":"12","author":"Radhakrishnan","year":"2015","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Miettinen, M., Marchal, S., Hafeez, I., Asokan, N., Sadeghi, A., and Tarkoma, S. (2017, January 5\u20138). IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT. Proceedings of the 37th IEEE International Conference on Distributed Computing Systems, ICDCS 2017, Atlanta, GA, USA.","DOI":"10.1109\/ICDCS.2017.283"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Sharaf-Dabbagh, Y., and Saad, W. (2016, January 21\u201324). On the authentication of devices in the Internet of things. Proceedings of the 17th IEEE International Symposium on A World of Wireless, Mobile and Multimedia Networks, WoWMoM 2016, Coimbra, Portugal.","DOI":"10.1109\/WoWMoM.2016.7523532"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"52903","DOI":"10.1109\/ACCESS.2019.2910848","article-title":"Device Identification Based on Communication Analysis for the Internet of Things","volume":"7","author":"Noguchi","year":"2019","journal-title":"IEEE Access"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Chang, C., R\u00fchrmair, U., Holcomb, D., and Guajardo, J. (2018, January 19). Behavioral Fingerprinting of IoT Devices. Proceedings of the 2018 Workshop on Attacks and Solutions in Hardware Security, ASHES@CCS 2018, Toronto, ON, Canada.","DOI":"10.1145\/3243734.3243873"},{"key":"ref_22","unstructured":"Seffah, A., Penzenstadler, B., Alves, C., and Peng, X. (2017, January 3\u20137). ProfilIoT: A machine learning approach for IoT device identification based on network traffic analysis. Proceedings of the Symposium on Applied Computing, SAC 2017, Marrakech, Morocco."},{"key":"ref_23","unstructured":"Meidan, Y., Bohadana, M., Shabtai, A., Ochoa, M., Tippenhauer, N.O., Guarnizo, J.D., and Elovici, Y. (2017). Detection of Unauthorized IoT Devices Using Machine Learning Techniques. arXiv."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1745","DOI":"10.1109\/TMC.2018.2866249","article-title":"Classifying IoT Devices in Smart Environments Using Network Traffic Characteristics","volume":"18","author":"Sivanathan","year":"2019","journal-title":"IEEE Trans. Mob. Comput."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Hamad, S.A., Zhang, W.E., Sheng, Q.Z., and Nepal, S. (2019, January 5\u20138). IoT Device Identification via Network-Flow Based Fingerprinting and Learning. Proceedings of the 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications\/13th IEEE International Conference On Big Data Science And Engineering, TrustCom\/BigDataSE 2019, Rotorua, New Zealand.","DOI":"10.1109\/TrustCom\/BigDataSE.2019.00023"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Shahid, M.R., Blanc, G., Zhang, Z., and Debar, H. (2018, January 10\u201313). IoT Devices Recognition Through Network Traffic Analysis. Proceedings of the IEEE International Conference on Big Data, Big Data 2018, Seattle, WA, USA.","DOI":"10.1109\/BigData.2018.8622243"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1402","DOI":"10.1109\/JSAC.2019.2904364","article-title":"Audi: Toward autonomous iot device-type identification using periodic communication","volume":"37","author":"Marchal","year":"2019","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Eom, J.h., Han, Y.J., Park, S.H., and Chung, T.M. (2008, January 16\u201320). Active cyber attack model for network system\u2019s vulnerability assessment. Proceedings of the 2008 International Conference on Information Science and Security (ICISS 2008), Jammu, India.","DOI":"10.1109\/ICISS.2008.36"},{"key":"ref_29","unstructured":"SolarWinds (2021, April 08). Detecting and Preventing Rogue Devices. Available online: https:\/\/www.solarwinds.com\/-\/media\/solarwinds\/swdcv2\/licensed-products\/user-device-tracker\/resources\/whitepaper\/udt_wp_detect_prevent_rogue_devices.ashx?rev=7a261fece0b940ceb814f4985e1d74ff."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1002\/(SICI)1097-4571(199401)45:1<12::AID-ASI2>3.0.CO;2-L","article-title":"The Relationship between Recall and Precision","volume":"45","author":"Buckland","year":"1994","journal-title":"J. Am. Soc. Inf. Sci."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/8\/2660\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T13:59:19Z","timestamp":1760363959000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/8\/2660"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,4,10]]},"references-count":30,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2021,4]]}},"alternative-id":["s21082660"],"URL":"https:\/\/doi.org\/10.3390\/s21082660","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,4,10]]}}}