Automatic IoT Device Classification using Traffic Behavioral Characteristics

Alexander Hsu, Joseph Tront, David Raymond, Gang Wang, Ali Butt

Research output: Chapter in Book/Report/Conference proceedingConference contribution


To protect the increasing presence of Internet of Things (IoT) devices in enterprise networks, it is necessary to detect and categorize new and existing IoT devices without relying on unencrypted data. We propose using machine learning to generalize network behavioral characteristics using data derived from the IP packet header. We capture traffic from 20 different IoT devices representing 4 distinct categories alongside a fifth category to recognize patterns from traditional computing devices. The traffic behavior of each category is then generalized and deployed to identify unknown devices that have never before entered the network. We then employ our techniques in a simulated production network and against the University of South Wales (UNSW) dataset. The results indicate that some IoT categories are easier to generalize than others, but better techniques in data generation and processing are needed in order to increase the classification confidence.

Original languageEnglish (US)
Title of host publication2019 IEEE SoutheastCon, SoutheastCon 2019
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9781728101378
StatePublished - Apr 2019
Externally publishedYes
Event2019 IEEE SoutheastCon, SoutheastCon 2019 - Huntsville, United States
Duration: Apr 11 2019Apr 14 2019

Publication series

NameConference Proceedings - IEEE SOUTHEASTCON
ISSN (Print)0734-7502


Conference2019 IEEE SoutheastCon, SoutheastCon 2019
CountryUnited States


  • IoT
  • Machine Learning
  • Network Traffic
  • Smart Devices

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Software
  • Electrical and Electronic Engineering
  • Control and Systems Engineering
  • Signal Processing

Fingerprint Dive into the research topics of 'Automatic IoT Device Classification using Traffic Behavioral Characteristics'. Together they form a unique fingerprint.

Cite this