Packet level measurement in the data plane provides a microscopic view of the network’s state. Although advances in programmable switches and routers make it possible to measure the Sequence of Packet Lengths and Arrival Times (SPLT) in the data plane, collecting this information remains challenging due to limited storage, processing resources, and bandwidth. To address this issue, we propose MES, which Measures and Encodes Simultaneously the packet length and timestamp when each packet passes through the Network Processor (NP) in the switch/router. We design the packet length compression and timestamp compression algorithms to be lightweight and implement the designed algorithms using simple operations supported by the network processor, while taking into account the computation constraints of the NP. Through extensive experiments on five packet traces, we demonstrate that our MES achieves high precision SPLT measurements (up to 99.82% cosine similarity) while reducing storage and bandwidth overhead by up to 87%. Simulations conducted on the BMV2 P4 software switch demonstrate that our designed SPLT measurement mechanism imposes little impact on network throughput and delay.

The rapid expansion of the Internet of Things (IoT) has led to growing concerns about the security of IoT devices. A crucial aspect of ensuring their security is IoT device identification, which involves pinpointing the specific type of device. Existing solutions, however, either necessitate complex feature engineering or struggle to handle the ever-increasing number of new devices in open IoT environments. To tackle these challenges, this paper introduces GraphIoT, a lightweight IoT device detection method based on graph classifiers. GraphIoT leverages lightweight flow information, such as packet length, direction, and timestamp, to create an IoT Device Traffic Graph Representation (IoT-DTGR). This representation offers a comprehensive view of IoT device flows while preserving features in bidirectional IoT Device-Gateway interactions. By transforming the IoT device detection problem into a graph classification problem, GraphIoT employs a powerful Graph Neural Network that takes into account both node and edge features, as well as subgraph structures in IoT-DTGRs, to classify graphs and consequently identify device types. Additionally, the paper proposes an incremental learning framework called CL-GraphIoT that continuously learns features of new IoT device flows without forgetting previously learned device features. This is achieved through two strategies: parameter sharing and sample replaying. The paper gathers a real-world dataset from 18 IoT devices and conducts experiments on two datasets: the gathered real-world dataset and an open-source dataset covering 21 IoT device types. The experimental results demonstrate that both GraphIoT and CL-GraphIoT outperform state-of-the-art methods, achieving high accuracy in device detection with fast processing speed.