Authors: Sandhya Aneja; Nagender Aneja; Bharat Bhargava; Rajarshi Roy Chowdhury
Addresses: Faculty of Integrated Tehnologies, Universiti Brunei Darussalam, Brunei Darussalam, Brunei ' Faculty of Science, Universiti Brunei Darussalam, Brunei Darussalam, Brunei ' Department of Computer Science, Purdue University, USA ' Faculty of Integrated Tehnologies, Universiti Brunei Darussalam, Brunei Darussalam, Brunei
Abstract: Device fingerprinting is a problem of identifying a network device using network traffic data to secure against cyber-attacks. Automated device classification from a large set of network traffic features space is challenging for the devices connected in the cyberspace. In this work, the idea is to define a device-specific unique fingerprint by analysing solely inter-arrival time of packets as a feature to identify a device. Neural networks are the universal function approximation which learn abstract, highlevel, nonlinear representation of training data. Deep convolution neural network is used on images of inter-arrival time signature for device fingerprinting of 58 non-IoT devices of 5-11 types. To evaluate the performance, we compared ResNet-50 layer and basic CNN-5 layer architectures. We observed that device type identification models perform better than device identification. We also found that when deep learning models are attacked over device signature, the models identify the change in signature, and classify the device in the wrong class thereby the classification performance of the models degrades. The performance of the models to detect the attacks are significantly different from each other though both models indicate the system under attack.
Keywords: device fingerprinting; deep convolutional neural networks; DCNN; ResNet-50; attack; attack defense.
International Journal of Communication Networks and Distributed Systems, 2022 Vol.28 No.2, pp.171 - 198
Received: 25 Feb 2021
Accepted: 28 Jun 2021
Published online: 28 Feb 2022 *