Internet of Things (IoT) devices have become increasingly prevalent, and while convenient they pose security risks and must be monitored to keep networks safe. The problem of identifying IoT devices by fingerprinting their network traffic has been studied, with various approaches emerging. While achieving good results, many solutions require complex feature extraction, considerable computational overhead, and extensive domain knowledge in both networking and machine learning to select relevant features and supporting ML algorithms. In addition, many current studies work to identify heterogeneous devices in an artificially sterile (lab) environment. To improve the process we introduce FlexHash, a system that uses a combination of locality-sensitive hashing and machine learning to identify specific devices based on a generic view of their network traffic characteristics. We successfully identify both heterogeneous and homogeneous (identical) devices in an environment with both live network noise and noise generated from other (unknown) IoT devices. FlexHash is able to consume unprocessed network traffic in the form of .pcap files and produce feature vectors capable of highly accurate device identification and anomaly detection. To enhance the strength of this approach we develop our own n-gram based hashing method allowing for various parameters in the algorithm to be tuned, making it possible to accurately differentiate individual devices from among a field of identical peers as well as device genre and heterogeneous devices with a single packet of network traffic.

Recent growth in the utilization of IoT has offered convenience and utility, but has also increased security risk. Many devices lack the capacity to support adequate encryption or other common means of protection, and are often designed for easy connection out-of-the-box exposing vulnerabilities related to default configurations. Managing IoT devices in a network can be difficult as MAC addresses are easily spoofed, creating a need for techniques to properly identify and monitor membership. Many of the proposed solutions for IoT device identification require complex feature extraction and engineering. In addition, little work has been done to identify individual devices from among identical peers. We propose a novel hashing algorithm, FlexHash, and show that we are able to identify identical devices with a very high degree of accuracy using only a single packet of network traffic. By applying hybrid locality sensitive hashing in combination with machine learning our approach achieves accuracy scores as high as 98% for identical devices and 99% for identifying device genre.

Network traffic fingerprinting is a valuable method for network monitoring enabling device identification and intrusion detection. Most of the fingerprinting methods utilize machine learning models. Since accuracy is a main concern in networking systems that employ traffic fingerprinting, the underlying models are also tuned to achieve high accuracy. While these systems are mostly deployed in dedicated servers with abundant computational power, in some cases models need to be deployed in resource-constrained environments such as edge servers, and routers. Thus in addition to accuracy, the computational overhead of the system should also be considered while tuning the models. In this paper, we present FlexiNet a lightweight network traffic fingerprinting system for resource-constrained environments. It relies on a genetic algorithm to make multi-objective tuning of hyperparameters of the models to optimize the system based on accuracy, and computational overhead (processing time, CPU, and memory usage). We evaluated FlexiNet in identifying 20 devices in a resource-limited environment with network traffic fingerprinting. We observed that with multi-objective optimization, FlexiNet can reduce processing time and memory usage by 7% and 56% respectively while compromising from f1-score only by 2% and achieving a score of 96%. We also observed that with a lightweight machine learning framework, FlexiNet can reduce time and memory overhead by more than 10% in different platforms.

The Internet of Things (IoT) introduced new complexities and challenges to computer networks. Due to their simple nature, these devices are more vulnerable to cyber-attacks. Thus it becomes important to identify these devices in a network for network management and detect malicious activities. Network traffic fingerprinting is an essential tool for device identification and anomaly detection, and existing approaches mainly rely on machine learning (ML). However, ML-based approaches require feature selection, hyperparameter tuning, and model retraining to achieve optimum results and be robust to concept drifts observed in a network. To overcome these challenges, in this paper we propose locality-sensitive hashing (LSH) based network traffic fingerprinting. Specifically, we explore design alternatives for the LSH function Nilsimsa and use it to fingerprint network traffic for device identification. We also compared it with ML-based traffic fingerprinting and observed that our method increases the accuracy of state-of-the-art by 12% achieving around 94% accuracy in identifying devices in a network.

The advancement in Internet of Things (IoT) technology has transformed our daily lifestyle. Particularly, voice assistants such as Amazon's Alexa and Google Assistant are commonly deployed in households. These voice assistants enable users to interact with other devices in a smart home ecosystem. In this paper, we focus on two security issues that arise with the use of smart speakers, and present network flow fingerprinting methods to mitigate their impact. First, we concentrate on the misactivation of smart speakers in which spoken words unintentionally activate the device. This may lead to private user conversations being recorded and sent to the cloud without the user even noticing. To prevent such misactivation, we explore locality-sensitive hash-based machine learning approaches. Our evaluation results with the network traffic of four different smart speakers show that the proposed approach can achieve an area under the curve (i. e., AUC) of 93% to 99%. Secondly, we explore whether the voice commands of the device owner can be distinguished from other individuals based on the generated network traffic fingerprint without any analysis of the actual sound wave. Evaluation results with five different user voices show that we can achieve an average AUC of 72% to 81% by ensembling multiple machine learning models.

Engineered systems get smarter with computing capabilities, particularly through a multitude of Internet-of-Things (IoT) devices. IoT devices, however, are prone to be compromised as they are often resource limited and optimized for a certain task. They lack computing power for security software hence, they have become a major target of malicious activities. In order to secure a network, administrators may isolate vulnerable devices and limit traffic to a device based on its communication needs. In this article, we introduce a novel approach to identify an IoT device based on the locality-sensitive hash of its traffic flow. Different from previous studies that employ machine learning, the proposed approach does not require feature extraction from the data, operates in all states of the device (e.g., setup, idle, and active), and does not require to retrain the model when a new device type/version is introduced. The evaluation results on different data sets show that our approach achieves precision and recall above 90% on average and performs equally well compared to the state-of-the-art machine learning-based methods.

Edge computing has become a recent approach to bring computing resources closer to the end-user. While offline processing and aggregate data reside in the cloud, edge computing is promoted for latency-critical and bandwidth-hungry tasks. In this direction, it is crucial to quantify the expected latency reduction when edge servers are preferred over cloud locations. In this paper, we performed an extensive measurement to assess the latency characteristics of end-users with respect to the edge servers and cloud data centers. We also evaluated the impact of capacity limitations of edge servers on the latency under various user workloads. We measured latency from 8,456 end-users to 6,341 Akamai edge servers and 69 cloud locations. Measurements of latencies show that while 58% of end-users can reach a nearby edge server in less than 10 ms, only 29% of end-users obtain a similar latency from a nearby cloud location. Additionally, we observe that the latency distribution of end-users to edge servers follows a power-law distribution, which emphasizes the need for non-uniform server deployment and load balancing by an edge provider.

Widespread adoption of Internet of Things (IoT) devices increased the variety of devices connected to a network. These devices have become a primary target of cyber-attacks as they introduce unmanaged vulnerabilities into the network. On the other hand, most of the IoT devices have a limited set of functionalities. Thus, it is possible to formulate the expected traffic pattern of the device and employ the network traffic to detect anomalous activities. Existing IoT traffic anomaly detection systems require tuning the parameters of machine learning algorithms used for the traffic classification. In this paper, we introduce a novel approach to detect the anomalous IoT network traffic based on the locality-sensitive hash of the traffic flow. The proposed Locality Sensitive Anomaly Detection (LSAD) approach does not require feature extraction from the data. Evaluation on a dataset with fifteen attacks shows that it can detect anomalous flows with an accuracy above 97% and achieve the same or better performance than machine learning approaches.

Systems get smarter with computing capabilities, especially in the form of Internet of Things (IoT) devices. IoT devices are often resource-limited as they are optimized for a certain task. Hence, they are prone to be compromised and have become a target of malicious activities. Since IoT devices lack computing power for security software, network administrators need to isolate such devices and limit traffic to the device based on their communication needs. To this end, network administrators need to identify IoT devices when they join a network and detect anomalous traffic when they are compromised. In this paper, we introduce a novel approach to identify the IoT device based on the Nilsimsa hash of its traffic flow. Different from previous studies, the proposed approach does not require feature extraction from the data. In our evaluations, our approach has an average precision and recall of 93% and 90%, respectively.

End-to-end integrity verification is designed to protect file transfers against silent data corruption by comparing checksum of files at source and destination end points using cryptographic hash functions such as MD5 and SHA1. However, existing implementations of end-to-end integrity verification for file transfers fall short to detect undetected disk errors that causes inconsistency between disk and cache memory. In this article, we propose Robust Integrity Verification Algorithm (RIVA) to strengthen the integrity of file transfers by forcing checksum computation tasks to read files directly from disk. RIVA achieves this by invalidating memory mappings of file pages after their transfer such that when the file is read again for checksum calculation, it will be fetched from disk and silent disk errors will be captured. We design and conduct extensive fault resilience experiments to evaluate the robustness of integrity verification algorithms against undetected disk write errors. The results indicate that while the state-of-the-art integrity verification algorithms fail to detect the injected errors for almost all file sizes, RIVA captures all of them with the help of cache invalidation. We further run statistical analysis to assess the probability of missing silent disk errors and find that RIVA reduces the likelihood by 10 to 15 orders of magnitude compared to the existing approaches. Finally, enforcing disk read in integrity verification introduces an inevitable overhead in exchange of increased robustness against silent disk errors, but RIVA keeps its overhead below 15 percent in most cases by running transfer, cache invalidation, and checksum computation processes concurrently for different portions of the same file.

Scientific applications generate large volumes of data that often needs to be moved between geographically distributed sites for collaboration or backup which has led to a significant increase in data transfer rates. As an increasing number of scientific applications are becoming sensitive to silent data corruption, end-to-end integrity verification has been proposed. It minimizes the likelihood of silent data corruption by comparing checksum of files at the source and the destination using secure hash algorithms such as MD5 and SHA1. In this paper, we investigate the robustness of existing end-to-end integrity verification approaches against silent data corruption and propose a Robust Integrity Verification Algorithm (RIVA) to enhance data integrity. Extensive experiments show that unlike existing solutions, RIVA is able to detect silent disk corruptions by invalidating file contents in page cache and reading them directly from disk. Since RIVA clears page cache and reads file contents directly from the disk, it incurs delay to execution time. However, by running transfer, cache invalidation, and checksum operations concurrently, RIVA is able to keep its overhead below 15% in most cases compared to the state-of-the-art solutions in exchange of increasing the robustness to silent data corruption. We also implemented dynamic transfer and checksum parallelism to overcome performance bottlenecks and observed more than 5x increase in RIVA's speed.