隨著物聯網 (IoT) 設備數量的快速增長，網路的資安危機也日益增加。大多數的物聯網設備資源有限，因此無法支持高階的防禦措施，另外加上物聯網的高度異質性，使物聯網設備難以有效管理。因此，近年來出現了設備指紋技術來識別和監控物聯網設備以確保設備及網路的正常運行。同時，由於物聯網環境快速發展，新型設備將不斷出現。因此能夠偵測未知設備，並且在不需高成本地重新訓練模型的情況下允許新設備類型加入網路也至關重要。在本論文中，我們提出了一個基於機器學習的物聯網設備指紋辨識系統。所提出的系統由基於離散小波轉換 (DWT) 的指紋提取方法和基於無監督式學習的集成一類分類器所組成。分類器的一類架構允許新設備類型加入網路而不需重新訓練模型。在實驗中我們使用了兩個被廣泛使用的資料集以評估性能，同時也評估了偵測未知設備的能力。實驗結果表明，所提出的指紋辨識方法有效地提高了兩個資料集的分類性能。我們也使用這兩個資料集來評估偵測未知設備的能力，實驗數據證明了所提出的機制能夠有效地偵測未知設備。

With the exponential growth in the number of Internet of Things (IoT) devices, cyber-security risks are also growing rapidly. Most IoT devices are limited in resources, thus unable to support more sophisticated security measures, and also highly diverse in terms of hardware and firmware. Therefore, it is crucial to identify and monitor the devices to ensure the orderly functioning of the IoT network. To achieve these goals, a promising research field focusing on device fingerprinting, which models the behavior or attributes of the device, has emerged. At the same time due to the evolving IoT environment, new types of devices are constantly introduced to the network. Thus, it is also essential to detect unknown device-types and allow them to join the network without a costly model retraining process. In this thesis, we proposed a machine learning-based IoT device fingerprinting system. The proposed system consists of the Discrete Wavelet Transform (DWT) based fingerprint extraction method, and the unsupervised ensemble one-class classification method that identifies devices based on their normal behavior. The one-class architecture of the classifier allows new device-types to join the network without retraining the model. We evaluated the performance using two of the most popular datasets and demonstrated the ability to detect unknown device-types. The evaluation results showed that the proposed fingerprinting method improves the classification performance for both datasets. We also evaluated the performance of the unknown device detection mechanism using both datasets, proving that it can detect unknown device-types effectively.

[1]. Ding, Jie, et al. "IoT connectivity technologies and applications: A survey." arXiv preprint arXiv:2002.12646 (2020).
[2]. Lueth, Knud Lasse. The Top 10 IoT Segments in 2018 – based on 1,600 real IoT projects. 2018; Available from: https://iot-analytics.com/top-10-iot-segments-2018-real-iot-projects/.
[3]. Lueth, Knud Lasse. State of the IoT 2018: Number of IoT devices now at 7B – Market accelerating. 2018; Available from: https://iot-analytics.com/state-of-the-iot-update-q1-q2-2018-number-of-iot-devices-now-7b/?fbclid=IwAR1JUnbqqfY8Tm6kakQ_VuekAlbpdP_zYlXJNb7CYLEq29bhn4Q8MydM75k.
[4]. Mohanta, Bhabendu Kumar, et al. "Survey on IoT security: Challenges and solution using machine learning, artificial intelligence and blockchain technology." Internet of Things 11 (2020): 100227.
[5]. Stathie, Silviu. Lack of Security in IoT Devices Explained. What Can We Do About It? 2020; Available from: https://securityboulevard.com/2020/10/lack-of-security-in-iot-devices-explained-what-can-we-do-about-it/.
[6]. Shoemaker, Andy. How to Identify a Mirai-Style DDoS Attack. 2017; Available from: https://www.imperva.com/blog/how-to-identify-a-mirai-style-ddos-attack/.
[7]. Sánchez, Pedro Miguel Sánchez, et al. "A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets." IEEE Communications Surveys & Tutorials (2021).
[8]. Tahaei, Hamid, et al. "The rise of traffic classification in IoT networks: A survey." Journal of Network and Computer Applications 154 (2020): 102538.
[9]. Kohno, Tadayoshi, et al. "Remote physical device fingerprinting." IEEE Transactions on Dependable and Secure Computing 2.2 (2005): 93-108.
[10]. Jana, Suman and Sneha K Kasera "On fast and accurate detection of unauthorized wireless access points using clock skews." IEEE transactions on Mobile Computing 9.3 (2009): 449-462.
[11]. Al-Sa’d, Mohammad F, et al. "RF-based drone detection and identification using deep learning approaches: An initiative towards a large open source drone database." Future Generation Computer Systems 100 (2019): 86-97.
[12]. Basak, Sanjoy, et al."Drone classification from RF fingerprints using deep residual nets." 2021 International Conference on COMmunication Systems & NETworkS (COMSNETS). IEEE, 2021.
[13]. Bassey, Joshua, et al."Intrusion detection for IoT devices based on RF fingerprinting using deep learning." 2019 Fourth International Conference on Fog and mobile edge computing (FMEC). IEEE, 2019.
[14]. Nouichi, Douae, et al."Iot devices security using rf fingerprinting." 2019 Advances in Science and Engineering Technology International Conferences (ASET). IEEE, 2019.
[15]. Tu, Ya, et al. "Research on the Internet of Things device recognition based on RF-fingerprinting." IEEE Access 7 (2019): 37426-37431.
[16]. Köse, Memduh, et al. "RF fingerprinting of IoT devices based on transient energy spectrum." IEEE Access 7 (2019): 18715-18726.
[17]. Mishra, Preeti, et al. "Vmguard: A vmi-based security architecture for intrusion detection in cloud environment." IEEE Transactions on Cloud Computing 8.3 (2018): 957-971.
[18]. Kubacki, Marcin and Janusz Sosnowski "Exploring operational profiles and anomalies in computer performance logs." Microprocessors and Microsystems 69 (2019): 1-15.
[19]. Liu, Zhen, et al. "A statistical pattern based feature extraction method on system call traces for anomaly detection." Information and Software Technology 126 (2020): 106348.
[20]. He, Sen, et al. "BoSMoS: A blockchain-based status monitoring system for defending against unauthorized software updating in industrial Internet of Things." IEEE Internet of Things Journal 7.2 (2019): 948-959.
[21]. Samir, Areeg and Claus Pahl "Detecting and localizing anomalies in container clusters using Markov models." Electronics 9.1 (2020): 64.
[22]. Shahid, Mustafizur R, et al."IoT devices recognition through network traffic analysis." 2018 IEEE international conference on big data (big data). IEEE, 2018.
[23]. Marchal, Samuel, et al. "Audi: Toward autonomous iot device-type identification using periodic communication." IEEE Journal on Selected Areas in Communications 37.6 (2019): 1402-1412.
[24]. Ammar, Nesrine, et al."Autonomous Identification of IoT Device Types based on a Supervised Classification." ICC 2020-2020 IEEE International Conference on Communications (ICC). IEEE, 2020.
[25]. Charyyev, Batyr and Mehmet Hadi Gunes."Iot event classification based on network traffic." IEEE INFOCOM 2020-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 2020.
[26]. Miettinen, Markus, et al."Iot sentinel: Automated device-type identification for security enforcement in iot." 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS). IEEE, 2017.
[27]. Aksoy, Ahmet and Mehmet Hadi Gunes."Automated iot device identification using network traffic." ICC 2019-2019 IEEE International Conference on Communications (ICC). IEEE, 2019.
[28]. Chowdhury, Rajarshi Roy, et al."Network Traffic Analysis based IoT Device Identification." Proceedings of the 2020 the 4th International Conference on Big Data and Internet of Things. 2020.
[29]. Sivanathan, Arunan, et al. "Classifying IoT devices in smart environments using network traffic characteristics." IEEE Transactions on Mobile Computing 18.8 (2018): 1745-1759.
[30]. Cirillo, Gennaro and Roberto Passerone "Packet Length Spectral Analysis for IoT Flow Classification Using Ensemble Learning." IEEE Access 8 (2020): 138616-138641.
[31]. Sivanathan, Arunan, et al. "Managing IoT cyber-security using programmable telemetry and machine learning." IEEE Transactions on Network and Service Management 17.1 (2020): 60-74.
[32]. Sivanathan, Arunan, et al. "Detecting behavioral change of IoT devices using clustering-based network traffic modeling." IEEE Internet of Things Journal 7.8 (2020): 7295-7309.
[33]. Antonello, Rafael, et al. "Deep packet inspection tools and techniques in commodity platforms: Challenges and trends." Journal of Network and Computer Applications 35.6 (2012): 1863-1878.
[34]. Summerville, Douglas H, et al."Ultra-lightweight deep packet anomaly detection for Internet of Things devices." 2015 IEEE 34th international performance computing and communications conference (IPCCC). IEEE, 2015.
[35]. Kotak, Jaidip and Yuval Elovici."IoT device identification using deep learning." Computational Intelligence in Security for Information Systems Conference. Springer, 2019.
[36]. Ortiz, Jorge, et al."DeviceMien: network device behavior modeling for identifying unknown IoT devices." Proceedings of the International Conference on Internet of Things Design and Implementation. 2019.
[37]. Shen, Jie, et al."IoT eye an efficient system for dynamic IoT devices auto-discovery on organization level." 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud). IEEE, 2017.
[38]. Ferrando, Roman and Paul Stacey."Classification of device behaviour in internet of things infrastructures: towards distinguishing the abnormal from security threats." Proceedings of the 1st International Conference on Internet of Things and Machine Learning. 2017.
[39]. Pacheco, Jesus and Salim Hariri "Anomaly behavior analysis for IoT sensors." Transactions on Emerging Telecommunications Technologies 29.4 (2018): e3188.
[40]. Lison, Pierre "An introduction to machine learning." Language Technology Group (LTG) 1.35 (2015).
[41]. LeCun, Yann, et al. "Deep learning." nature 521.7553 (2015): 436-444.
[42]. Ezuma, Martins, et al. "Detection and classification of UAVs using RF fingerprints in the presence of Wi-Fi and Bluetooth interference." IEEE Open Journal of the Communications Society 1 (2019): 60-76.
[43]. Allahham, Mhd Saria, et al."Deep learning for RF-based drone detection and identification: A multi-channel 1-D convolutional neural networks approach." 2020 IEEE International Conference on Informatics, IoT, and Enabling Technologies (ICIoT). IEEE, 2020.
[44]. OConnor, TJ, et al."HomeSnitch: behavior transparency and control for smart home IoT devices." Proceedings of the 12th conference on security and privacy in wireless and mobile networks. 2019.
[45]. Selis, Valerio and Alan Marshall "A classification-based algorithm to detect forged embedded machines in IoT environments." IEEE Systems Journal 13.1 (2018): 389-399.
[46]. Bhatia, Randeep, et al."Unsupervised machine learning for network-centric anomaly detection in iot." Proceedings of the 3rd acm conext workshop on big data, machine learning and artificial intelligence for data communication networks. 2019.
[47]. Hasan, Mahmudul, et al. "Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches." Internet of Things 7 (2019): 100059.
[48]. Radhakrishnan, Sakthi Vignesh, et al. "Gtid: A technique for physical device and device type fingerprinting." IEEE Transactions on Dependable and Secure Computing 12.5 (2014): 519-532.
[49]. Pinheiro, Antônio J, et al. "Identifying IoT devices and events based on packet length from encrypted traffic." Computer Communications 144 (2019): 8-17.
[50]. Chun-Lin, Liu "A tutorial of the wavelet transform." NTUEE, Taiwan (2010).
[51]. Pedregosa, Fabian, et al. "Scikit-learn: Machine learning in Python." the Journal of machine Learning research 12 (2011): 2825-2830.