FlexHash

Internet of Things (IoT) devices have become in-creasingly prevalent, and while convenient they pose security risksand must be monitored to keep networks safe. The problem ofidentifying IoT devices by fingerprinting their network traffichas been studied, with various approaches emerging. Whileachieving good results, many solutions require complex featureextraction, considerable computational overhead, and extensivedomain knowledge in both networking and machine learningto select relevant features and supporting ML algorithms. Inaddition, many current studies work to identify heterogeneousdevices in an artificially sterile (lab) environment. To improve theprocess we introduce FlexHash, a system that uses a combinationof locality-sensitive hashing and machine learning to identifyspecific devices based on a generic view of their network trafficcharacteristics. We successfully identify both heterogeneous andhomogeneous (identical) devices in an environment with both livenetwork noise and noise generated from other (unknown) IoTdevices. FlexHash is able to consume unprocessed network trafficin the form of .pcap files and produce feature vectors capableof highly accurate device identification and anomaly detection.To enhance the strength of this approach we develop our ownn-gram based hashing method allowing for various parametersin the algorithm to be tuned, making it possible to accuratelydifferentiate individual devices from among a field of identicalpeers as well as device genre and heterogeneous devices with asingle packet of network traffic.