IoT Firmware Version Identification Using Transfer Learning with Twin Neural Networks

• URL: http://arxiv.org/abs/2501.06033v1
• Date: Fri, 10 Jan 2025 15:11:33 GMT
• Title: IoT Firmware Version Identification Using Transfer Learning with Twin Neural Networks
• Authors: Ashley Andrews, George Oikonomou, Simon Armour, Paul Thomas, Thomas Cattermole,
• Abstract summary: Research has largely neglected the identification of IoT device firmware versions. Traditional machine learning algorithms are ill-suited for effective version identification. We introduce an effective technique for identifying IoT device versions based on transfer learning.
• Score: 3.361262113290271
• License:
• Abstract: As the Internet of Things (IoT) becomes more embedded within our daily lives, there is growing concern about the risk `smart' devices pose to network security. To address this, one avenue of research has focused on automated IoT device identification. Research has however largely neglected the identification of IoT device firmware versions. There is strong evidence that IoT security relies on devices being on the latest version patched for known vulnerabilities. Identifying when a device has updated (has changed version) or not (is on a stable version) is therefore useful for IoT security. Version identification involves challenges beyond those for identifying the model, type, and manufacturer of IoT devices, and traditional machine learning algorithms are ill-suited for effective version identification due to being limited by the availability of data for training. In this paper, we introduce an effective technique for identifying IoT device versions based on transfer learning. This technique relies on the idea that we can use a Twin Neural Network (TNN) - trained at distinguishing devices - to detect differences between a device on different versions. This facilitates real-world implementation by requiring relatively little training data. We extract statistical features from on-wire packet flows, convert these features into greyscale images, pass these images into a TNN, and determine version changes based on the Hedges' g effect size of the similarity scores. This allows us to detect the subtle changes present in on-wire traffic when a device changes version. To evaluate our technique, we set up a lab containing 12 IoT devices and recorded their on-wire packet captures for 11 days across multiple firmware versions. For testing data held out from training, our best performing model is shown to be 95.83% and 84.38% accurate at identifying stable versions and version changes respectively.

Related papers

• IoT Device Labeling Using Large Language Models [3.3044728148521623]
  We tackle a key challenge in IoT labeling: how can an AI solution label an IoT device that has never been seen before and whose label is unknown? Our solution extracts textual features such as domain names and catalogs from network traffic, and then enriches these features using Google search data alongside catalog of vendors and device functions. The solution also integrates an auto-update mechanism that uses Large Language Models (LLMs) to update these emerging device types.
  arXiv  Detail & Related papers  (2024-03-03T18:41:22Z)
• Effective Intrusion Detection in Heterogeneous Internet-of-Things Networks via Ensemble Knowledge Distillation-based Federated Learning [52.6706505729803]
  We introduce Federated Learning (FL) to collaboratively train a decentralized shared model of Intrusion Detection Systems (IDS) FLEKD enables a more flexible aggregation method than conventional model fusion techniques. Experiment results show that the proposed approach outperforms local training and traditional FL in terms of both speed and performance.
  arXiv  Detail & Related papers  (2024-01-22T14:16:37Z)
• Internet of Things: Digital Footprints Carry A Device Identity [0.0]
  Device fingerprinting (DFP) model is able to distinguish between Internet of Things (IoT) and non-IoT devices. Four statistical features have been extracted from the consecutive five device-originated packets, to generate individual device fingerprints.
  arXiv  Detail & Related papers  (2023-01-01T02:18:02Z)
• Adversarial attacks and defenses on ML- and hardware-based IoT device fingerprinting and identification [0.0]
  This work proposes an LSTM-CNN architecture based on hardware performance behavior for individual device identification. Previous techniques have been compared with the proposed architecture using a hardware performance dataset collected from 45 Raspberry Pi devices. adversarial training and model distillation defense techniques are selected to improve the model resilience to evasion attacks.
  arXiv  Detail & Related papers  (2022-12-30T13:11:35Z)
• AFR-Net: Attention-Driven Fingerprint Recognition Network [47.87570819350573]
  We improve initial studies on the use of vision transformers (ViT) for biometric recognition, including fingerprint recognition. We propose a realignment strategy using local embeddings extracted from intermediate feature maps within the networks to refine the global embeddings in low certainty situations. This strategy can be applied as a wrapper to any existing deep learning network (including attention-based, CNN-based, or both) to boost its performance.
  arXiv  Detail & Related papers  (2022-11-25T05:10:39Z)
• Revisiting IoT Device Identification [4.451756374933898]
  Internet-of-Things (IoT) devices are known to be the source of many security problems. We explore how to accurately identify IoT devices based on their network behavior.
  arXiv  Detail & Related papers  (2021-07-16T11:01:45Z)
• Federated Learning-based Active Authentication on Mobile Devices [98.23904302910022]
  User active authentication on mobile devices aims to learn a model that can correctly recognize the enrolled user based on device sensor information. We propose a novel user active authentication training, termed as Federated Active Authentication (FAA) We show that existing FL/SL methods are suboptimal for FAA as they rely on the data to be distributed homogeneously.
  arXiv  Detail & Related papers  (2021-04-14T22:59:08Z)
• Unsupervised Pretraining for Object Detection by Patch Reidentification [72.75287435882798]
  Unsupervised representation learning achieves promising performances in pre-training representations for object detectors. This work proposes a simple yet effective representation learning method for object detection, named patch re-identification (Re-ID) Our method significantly outperforms its counterparts on COCO in all settings, such as different training iterations and data percentages.
  arXiv  Detail & Related papers  (2021-03-08T15:13:59Z)
• The Case for Retraining of ML Models for IoT Device Identification at the Edge [0.026215338446228163]
  We show how to identify IoT devices based on their network behavior using resources available at the edge of the network. It is possible to achieve device identification and categorization with over 80% and 90% accuracy respectively at the edge.
  arXiv  Detail & Related papers  (2020-11-17T13:01:04Z)
• Contextual-Bandit Anomaly Detection for IoT Data in Distributed Hierarchical Edge Computing [65.78881372074983]
  IoT devices can hardly afford complex deep neural networks (DNN) models, and offloading anomaly detection tasks to the cloud incurs long delay. We propose and build a demo for an adaptive anomaly detection approach for distributed hierarchical edge computing (HEC) systems. We show that our proposed approach significantly reduces detection delay without sacrificing accuracy, as compared to offloading detection tasks to the cloud.
  arXiv  Detail & Related papers  (2020-04-15T06:13:33Z)
• IoT Device Identification Using Deep Learning [43.0717346071013]
  The growing use of IoT devices in organizations has increased the number of attack vectors available to attackers. The widely adopted bring your own device (BYOD) policy which allows an employee to bring any IoT device into the workplace and attach it to an organization's network also increases the risk of attacks. In this study, we applied deep learning on network traffic to automatically identify IoT devices connected to the network.
  arXiv  Detail & Related papers  (2020-02-25T12:24:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.