{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T05:00:47Z","timestamp":1784955647332,"version":"3.55.0"},"reference-count":29,"publisher":"MDPI AG","issue":"15","license":[{"start":{"date-parts":[[2026,7,23]],"date-time":"2026-07-23T00:00:00Z","timestamp":1784764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Internet-of-Things (IoT) devices in smart homes are vulnerable to passive traffic fingerprinting, where an adversary captures encrypted IEEE 802.11 frames and identifies devices using MAC-layer metadata such as packet sizes and inter-arrival times. Existing defenses based on padding, traffic shaping, or synthetic cover traffic can remain vulnerable because artificial timing signatures are detectable by machine learning classifiers. This paper proposes a game-theoretic framework for evaluating Wi-Fi MAC-layer cover-traffic injection defenses. We introduce donor-based mimicry injection, in which the access point injects a replica of a paired device\u2019s authentic traffic into each device\u2019s stream. We compare donor mimicry with fixed-rate, exponential, and uniform synthetic baselines across 198 scenario instances (156 unique defender configurations) and eight classifiers using 10-fold cross-validation. Donor mimicry at 100% bandwidth overhead reduces the best attacker\u2019s balanced accuracy to 33.5%, whereas synthetic methods at equal overhead reach 93.9%, showing that behavioral realism, rather than injected volume alone, drives effectiveness. Modeling the interaction as a finite two-player zero-sum game yields a mixed-strategy Nash equilibrium with game value 0.247 within the evaluated strategy space; a deployable deterministic defense holds the best pairing-unaware attacker to 25.9% balanced accuracy, near the four-class random baseline of 25%. A pairing-aware robustness analysis shows that an attacker who can orient the donor-induced identity swap recovers near-baseline accuracy, so the four-class protection presumes pairing secrecy and the durable effect is pair-level anonymity. The defense operates at the access point and requires no IoT device modifications.<\/jats:p>","DOI":"10.3390\/s26154690","type":"journal-article","created":{"date-parts":[[2026,7,23]],"date-time":"2026-07-23T17:13:17Z","timestamp":1784826797000},"page":"4690","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Game-Theoretic Obfuscation of Wi-Fi MAC-Layer Traffic Against IoT Device Fingerprinting Attacks"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-7755-0486","authenticated-orcid":false,"given":"Abdulmajeed","family":"Alghamdi","sequence":"first","affiliation":[{"name":"Department of Computer and Network Engineering, College of Computing, Umm Al-Qura University, Makkah 24382, Saudi Arabia"},{"name":"Department of Electrical and Computer Engineering, University of Central Florida, Orlando, FL 32816, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-3026-5236","authenticated-orcid":false,"given":"Mnassar","family":"Alyami","sequence":"additional","affiliation":[{"name":"Department of Computer Sciences, College of Engineering and Computer Sciences, Jazan University, Jazan 45142, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-7335-6972","authenticated-orcid":false,"given":"Inad","family":"Alqurashi","sequence":"additional","affiliation":[{"name":"Civil Engineering Department, College of Engineering, Taif University, Taif 21944, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4229-6957","authenticated-orcid":false,"given":"Cliff C.","family":"Zou","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Central Florida, Orlando, FL 32816, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,7,23]]},"reference":[{"key":"ref_1","unstructured":"Alyami, M., Alkhowaiter, M., Al Ghanim, M., Zou, C., and Solihin, Y. (July, January 30). MAC-Layer Traffic Shaping Defense Against WiFi Device Fingerprinting Attacks. Proceedings of the 27th IEEE Symposium on Computers and Communications (ISCC), Rhodes, Greece."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Bezawada, B., Bachani, M., Peterson, J., Shirazi, H., and Ray, I. (2018, January 15\u201319). Behavioral Fingerprinting of IoT Devices. Proceedings of the ACM CCS Workshop on Attacks and Solutions in Hardware Security, Toronto, ON, Canada.","DOI":"10.1145\/3266444.3266452"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Msadek, N., Soua, R., and Engel, T. (2019, January 15\u201318). IoT Device Fingerprinting: Machine Learning Based Encrypted Traffic Analysis. Proceedings of the IEEE Wireless Communications and Networking Conference (WCNC), Marrakesh, Morocco.","DOI":"10.1109\/WCNC.2019.8885429"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"20386","DOI":"10.1109\/ACCESS.2020.2969015","article-title":"Traffic Fingerprinting Attacks on Internet of Things Using Machine Learning","volume":"8","author":"Skowron","year":"2020","journal-title":"IEEE Access"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"e1337","DOI":"10.1002\/widm.1337","article-title":"Behavioral Fingerprinting of Internet-of-Things Devices","volume":"11","author":"Bezawada","year":"2021","journal-title":"WIREs Data Min. Knowl. Discov."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Mir, M.M., Tan, W.L., Awrangjeb, M., and Zia, A. (2024, January 27\u201329). A Comparative Analysis of IoT Device Fingerprinting Methods. Proceedings of the 34th International Telecommunication Networks and Applications Conference (ITNAC), Sydney, Australia.","DOI":"10.1109\/ITNAC62915.2024.10815418"},{"key":"ref_7","unstructured":"Baena, E., Yang, H., Koutsonikolas, D., and Haque, I. (2025). A Comprehensive Survey on Smart Home IoT Fingerprinting: From Detection to Prevention and Practical Deployment. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Li, R., Liu, S., Hu, H., Ye, Q., and Feamster, N. (2025). WiFinger: Fingerprinting Noisy IoT Event Traffic Using Packet-level Sequence Matching. arXiv.","DOI":"10.14722\/ndss.2026.241083"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"149","DOI":"10.1109\/TDSC.2025.3605197","article-title":"WFCAT: Augmenting Website Fingerprinting with Channel-wise Attention on Timing Features","volume":"23","author":"Gong","year":"2026","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Engelberg, A., and Wool, A. (2022, January 7). Classification of Encrypted IoT Traffic despite Padding and Shaping. Proceedings of the 21st Workshop on Privacy in the Electronic Society (WPES), Los Angeles, CA, USA.","DOI":"10.1145\/3559613.3563191"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Medury, L., Robinson, L., and Kandah, F. (2025, January 14\u201316). A Dynamic GAN-Based Obfuscation Approach Against Profiling Attacks. Proceedings of the 50th IEEE Conference on Local Computer Networks (LCN), Sidney, Australia.","DOI":"10.1109\/LCN65610.2025.11146296"},{"key":"ref_12","unstructured":"Wan, Z., Cho, J.H., Lu, C.T., Ji, B., Moore, T.J., and Kamhoua, C. (2025). Game-Theoretic and Machine Learning-Based Defensive Deception for Dependable and Secure Cyber-Physical Systems, Virginia Tech. Technical Report."},{"key":"ref_13","unstructured":"Yang, Y.T., and Zhu, Q. (2024). Game-Theoretic Foundations for Cyber Resilience Against Deceptive Information Attacks in Intelligent Transportation Systems. arXiv."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"264","DOI":"10.1109\/TIFS.2024.3515796","article-title":"DeepCRF: Deep Learning-Enhanced CSI-Based RF Fingerprinting for Channel-Resilient WiFi Device Identification","volume":"20","author":"Kong","year":"2025","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Amamra, A., Anunwah, J.C., and Louafi, H. (2025). IoT Device Fingerprinting via Frequency Domain Analysis. Electronics, 14.","DOI":"10.3390\/electronics14163248"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Alyami, M., Alghamdi, A., Alkhowaiter, M.A., Zou, C., and Solihin, Y. (2023). Random Segmentation: New Traffic Obfuscation against Packet-Size-Based Side-Channel Attacks. Electronics, 12.","DOI":"10.3390\/electronics12183816"},{"key":"ref_17","first-page":"128","article-title":"Keeping the Smart Home Private with Smart(er) IoT Traffic Shaping","volume":"2019","author":"Apthorpe","year":"2019","journal-title":"Proc. Priv. Enhancing Technol."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"11434","DOI":"10.1109\/JIOT.2021.3126453","article-title":"Preserving Contextual Privacy for Smart Home IoT Devices With Dynamic Traffic Shaping","volume":"9","author":"Brahma","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1162","DOI":"10.1109\/TNET.2021.3140174","article-title":"Network Traffic Shaping for Enhancing Privacy in IoT Systems","volume":"30","author":"Xiong","year":"2022","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Narayanan, S. (2025). Software-Optimized Dynamic Traffic Padding for Enhancing Privacy in Smart Home IoT Networks. Int. J. Inf. Technol., 1\u201313.","DOI":"10.1007\/s41870-025-02508-x"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Juarez, M., Imani, M., Perry, M., Diaz, C., and Wright, M. (2016). Toward an Efficient Website Fingerprinting Defense. Proceedings of the 21st European Symposium on Research in Computer Security (ESORICS), Heraklion, Greece, 26\u201330 September 2016, Springer.","DOI":"10.1007\/978-3-319-45744-4_2"},{"key":"ref_22","unstructured":"Zhou, J., Du, Y., Ma, L., Shen, Z., Criswell, J., and Walls, R.J. (2020, January 12\u201314). Zero-Delay Lightweight Defenses against Website Fingerprinting. Proceedings of the 29th USENIX Security Symposium, Boston, MA, USA. Available online: https:\/\/dl.acm.org\/doi\/10.5555\/3489212.3489253."},{"key":"ref_23","first-page":"344","article-title":"RegulaTor: A Straightforward Website Fingerprinting Defense","volume":"2022","author":"Holland","year":"2022","journal-title":"Proc. Priv. Enhancing Technol."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"5520","DOI":"10.1109\/TIFS.2024.3402055","article-title":"RL and Fingerprinting to Select Moving Target Defense Mechanisms for Zero-Day Attacks in IoT","volume":"19","author":"Schenk","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1016\/j.future.2023.10.011","article-title":"Adversarial Attacks and Defenses on ML- and Hardware-Based IoT Device Fingerprinting and Identification","volume":"152","author":"Bovet","year":"2024","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1007\/978-3-030-64793-3_3","article-title":"A Realistic Approach for Network Traffic Obfuscation Using Adversarial Machine Learning","volume":"Volume 12513","author":"Granados","year":"2020","journal-title":"Decision and Game Theory for Security"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Verma, G., Ciftcioglu, E., Sheatsley, R., Chan, K., and Scott, L. (2018, January 29\u201331). Network Traffic Obfuscation: An Adversarial Machine Learning Approach. Proceedings of the IEEE Military Communications Conference (MILCOM), Los Angeles, CA, USA.","DOI":"10.1109\/MILCOM.2018.8599680"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"111707","DOI":"10.1016\/j.comnet.2025.111707","article-title":"TOPLDM: Towards Dynamic Low Overhead Traffic Obfuscation Based on Packet Length Distribution Modification","volume":"272","author":"Hu","year":"2025","journal-title":"Comput. Netw."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"9823","DOI":"10.1109\/JIOT.2023.3236314","article-title":"Over-the-Air Adversarial Attacks on Deep Learning Wi-Fi Fingerprinting","volume":"10","author":"Xiao","year":"2023","journal-title":"IEEE Internet Things J."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/15\/4690\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T04:12:47Z","timestamp":1784952767000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/15\/4690"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,23]]},"references-count":29,"journal-issue":{"issue":"15","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["s26154690"],"URL":"https:\/\/doi.org\/10.3390\/s26154690","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,23]]}}}