Analyzing consumer IoT traffic from security and privacy perspectives: a comprehensive survey

Abstract

The Consumer Internet of Things (CIoT), a notable segment within the IoT domain, involves the integration of IoT technology into consumer electronics and devices, such as smart homes and smart wearables. Compared to traditional IoT fields, CIoT differs notably in target users, product types, and design approaches. While offering convenience to users, it also raises new security and privacy concerns. Network traffic analysis, a widely used technique in the security community, has been extensively applied to investigate these concerns about CIoT. Compared to traditional network traffic analysis in fields like mobile apps and websites, CIoT introduces unique characteristics that pose new challenges and research opportunities. Researchers have made significant contributions in this area. To aid researchers in understanding the application of traffic analysis tools for assessing CIoT security and privacy risks, this survey reviews 310 publications on traffic analysis within the CIoT security and privacy domain from January 2018 to June 2024, focusing on three research questions. Our work: 1) outlines the CIoT traffic analysis process and highlights its differences from general network traffic analysis; 2) summarizes and classifies existing research into four categories according to its application objectives, device fingerprinting, user activity inference, malicious traffic detection, and measurement; 3) explores emerging challenges and potential future research directions based on each step of the CIoT traffic analysis process. This will provide new insights to the community and guide the industry towards safer product designs.

Graphical abstract

Keywords

consumer IoT / smart home / consumer IoT security / user privacy / traffic analysis / survey

References

[1] Alzahrani A I A, Chauhdary S H, Alshdadi A A . Internet of things (IoT)-based wastewater management in smart cities. Electronics, 2023, 12( 12): 2590

[2] Kumar B S, Ramalingam S, Divya V, Amruthavarshini S, Dhivyashree S. LoRa - IoT based industrial automation motor speed control monitoring system. In: Proceedings of 2023 International Conference on Intelligent Data Communication Technologies and Internet of Things (IDCIoT). 2023, 11−15

[3] Guenfaf Y, Zafoune Y. An IoT ml-based system for energy efficiency in smart homes. In: Proceedings of 2023 IEEE World AI IoT Congress (AIIoT). 2023, 198−203

[4] Mehta K, Gaur S, Maheshwari S, Chugh H, Kumar M A. Big data analytics cloud based smart IoT healthcare network. In: Proceedings of the 7th International Conference on Trends in Electronics and Informatics (ICOEI). 2023, 437−443

[5] Emami-Naeini P, Bhagavatula S, Habib H, Degeling M, Bauer L, Cranor L F, Sadeh N. Privacy expectations and preferences in an IoT world. In: Proceedings of the 13th USENIX Conference on Usable Privacy and Security. 2017, 399−412

[6] Zeng E, Mare S, Roesner F. End user security & privacy concerns with smart homes. In: Proceedings of the 13th USENIX Conference on Usable Privacy and Security. 2017, 65−80

[7] Park S, Lenhart A, Zimmer M, Vitak J. “Nobody’s happy”: design insights from privacy-conscious smart home power users on enhancing data transparency, visibility, and control. In: Proceedings of the 19th USENIX Conference on Usable Privacy and Security. 2023, 30

[8] Tawalbeh L, Muheidat F, Tawalbeh M, Quwaider M . IoT privacy and security: challenges and solutions. Applied Sciences, 2020, 10( 12): 4102

[9] Jia Y, Yuan B, Xing L, Zhao D, Zhang Y, Wang X, Liu Y, Zheng K, Crnjak P, Zhang Y, Zou D, Jin H. Who’s in control? On security risks of disjointed IoT device management channels. In: Proceedings of 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021, 1289−1305

[10] Jia Y, Xing L, Mao Y, Zhao D, Wang X, Zhao S, Zhang Y. Burglars’ IoT paradise: understanding and mitigating security risks of general messaging protocols on IoT clouds. In: Proceedings of 2020 IEEE Symposium on Security and Privacy (SP). 2020, 465−481

[11] Wang Q, Ji S, Tian Y, Zhang X, Zhao B, Kan Y, Lin Z, Lin C, Deng S, Liu A X, Beyah R. MPInspector: a systematic and automatic approach for evaluating the security of IoT messaging protocols. In: Proceedings of the 30th USENIX Security Symposium. 2021, 4205−4222

[12] Ren J, Dubois D J, Choffnes D, Mandalari A M, Kolcun R, Haddadi H. Information exposure from consumer IoT devices: a multidimensional, network-informed measurement approach. In: Proceedings of the Internet Measurement Conference. 2019, 267−279

[13] Iqbal U, Bahrami P N, Trimananda R, Cui H, Gamero-Garrido A, Dubois D J, Choffnes D, Markopoulou A, Roesner F, Shafiq Z. Tracking, profiling, and ad targeting in the Alexa echo smart speaker ecosystem. In: Proceedings of 2023 ACM on Internet Measurement Conference. 2023, 569−583

[14] Girish A, Hu T, Prakash V, Dubois D J, Matic S, Huang D Y, Egelman S, Reardon J, Tapiador J, Choffnes D, Vallina-Rodriguez N. In the room where it happens: characterizing local communication and threats in smart homes. In: Proceedings of 2023 ACM on Internet Measurement Conference. 2023, 437–456

[15] Tan Z, Jamdagni A, He X, Nanda P, Liu R P . A system for denial-of-service attack detection based on multivariate correlation analysis. IEEE Transactions on Parallel and Distributed Systems, 2014, 25( 2): 447–456

[16] Deri L, Sartiano D . Using dpi and statistical analysis in encrypted network traffic monitoring. International Journal for Information Security Research, 2020, 10( 1): 932–943

[17] Alzubi J, Nayyar A, Kumar A. Machine learning from theory to algorithms: an overview. In: Proceedings of the 2nd National Conference on Computational Intelligence. 2018, 012012

[18] Samuel A L . Some studies in machine learning using the game of checkers. IBM Journal of Research and Development, 1959, 3( 3): 210–229

[19] LeCun Y, Bengio Y, Hinton G . Deep learning. Nature, 2015, 521( 7553): 436–444

[20] Watkins C J C H. Learning from delayed rewards. University of Cambridge, Dissertation, 1989

[21] Duan C, Li S, Lin H, Chen W, Song G, Li C, Yang J, Wang Z . IoTa: fine-grained traffic monitoring for IoT devices via fully packet-level models. IEEE Transactions on Dependable and Secure Computing, 2024, 21( 4): 3931–3947

[22] James F, Ray I, Medhi D. Worst attack vulnerability and fortification for IoT security management: an approach and an illustration for smart home IoT. In: Proceedings of 2023 IEEE/IFIP Network Operations and Management Symposium. 2023, 1−6

[23] Charyyev B, Gunes M H . Locality-sensitive IoT network traffic fingerprinting for device identification. IEEE Internet of Things Journal, 2021, 8( 3): 1272–1281

[24] Charyyev B, Gunes M H. IoT traffic flow identification using locality sensitive hashes. In: Proceedings of 2020 IEEE International Conference on Communications (ICC). 2020, 1−6

[25] Seliem M, Elgazzar K, Khalil K . Towards privacy preserving IoT environments: a survey. Wireless Communications and Mobile Computing, 2018, 2018( 1): 1032761

[26] Gupta S, Ghanavati S. Privacy in the internet of things: Where do we stand? a systematic literature review. 2022

[27] Zavalyshyn I, Legay A, Rath A, Rivière E . SoK: privacy-enhancing smart home hubs. Proceedings on Privacy Enhancing Technologies, 2022, 2022( 4): 24–43

[28] Alrawi O, Lever C, Antonakakis M, Monrose F. SoK: security evaluation of home-based IoT deployments. In: Proceedings of 2019 IEEE Symposium on Security and Privacy (SP). 2019, 1362−1380

[29] Abosata N, Al-Rubaye S, Inalhan G, Emmanouilidis C . Internet of things for system integrity: a comprehensive survey on security, attacks and countermeasures for industrial applications. Sensors, 2021, 21( 11): 3654

[30] Wang Z, Liu D, Sun Y, Pang X, Sun P, Lin F, Lui J C S, Ren K . A survey on IoT-enabled home automation systems: attacks and defenses. IEEE Communications Surveys & Tutorials, 2022, 22( 4): 2292–2328

[31] Papadogiannaki E, Ioannidis S . A survey on encrypted network traffic analysis applications, techniques, and countermeasures. ACM Computing Surveys (CSUR), 2022, 54( 6): 123

[32] Shen M, Ye K, Liu X, Zhu L, Kang J, Yu S, Li Q, Xu K . Machine learning-powered encrypted network traffic analysis: a comprehensive survey. IEEE Communications Surveys & Tutorials, 2023, 25( 1): 791–824

[33] Shahraki A, Abbasi M, Taherkordi A, Jurcut A D . A comparative study on online machine learning techniques for network traffic streams analysis. Computer Networks, 2022, 207: 108836

[34] Mathews N, Holland J K, Oh S E, Rahman M S, Hopper N, Wright M. SoK: a critical evaluation of efficient website fingerprinting defenses. In: Proceedings of 2023 IEEE Symposium on Security and Privacy (SP). 2023, 969−986

[35] Agrawal A, Bhatia A, Bahuguna A, Tiwari K, Haribabu K, Vishwakarma D, Kaushik R . A survey on analyzing encrypted network traffic of mobile devices. International Journal of Information Security, 2022, 21( 4): 873–915

[36] Sánchez P M S, Valero J M J, Celdrán A H, Bovet G, Pérez M G, Pérez G M . A survey on device behavior fingerprinting: data sources, techniques, application scenarios, and datasets. IEEE Communications Surveys & Tutorials, 2021, 23( 2): 1048–1077

[37] Jmila H, Blanc G, Shahid M R, Lazrag M . A survey of smart home IoT device classification using machine learning-based network traffic analysis. IEEE Access, 2022, 10: 97117–97141

[38] Tahaei H, Afifi F, Asemi A, Zaki F, Anuar N B . The rise of traffic classification in IoT networks: a survey. Journal of Network and Computer Applications, 2020, 154: 102538

[39] Koroniotis N, Moustafa N, Sitnikova E, Turnbull B . Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: bot-IoT dataset. Future Generation Computer Systems, 2019, 100: 779–796

[40] Zhang K, Marchiori A. Crowdsourcing low-power wide-area IoT networks. In: Proceedings of 2017 IEEE International Conference on Pervasive Computing and Communications (PerCom). 2017, 41−49

[41] Gan X, Li Y, Huang Y, Fu L, Wang X . When crowdsourcing meets social IoT: an efficient privacy-preserving incentive mechanism. IEEE Internet of Things Journal, 2019, 6( 6): 9707–9721

[42] De Keersmaeker F, Cao Y, Ndonda G K, Sadre R . A survey of public IoT datasets for network security research. IEEE Communications Surveys & Tutorials, 2023, 25( 3): 1808–1840

[43] Ahmed D, Das A, Zaffar F . Analyzing the feasibility and generalizability of fingerprinting internet of things devices. Proceedings on Privacy Enhancing Technologies, 2022, 2022( 2): 578–600

[44] Perdisci R, Papastergiou T, Alrawi O, Antonakakis M. IoTFinder: efficient large-scale identification of IoT devices via passive DNS traffic analysis. In: Proceedings of 2020 IEEE European Symposium on Security and Privacy (EuroS&P). 2020, 474−489

[45] Sivanathan A, Gharakheili H H, Loi F, Radford A, Wijenayake C, Vishwanath A, Sivaraman V . Classifying IoT devices in smart environments using network traffic characteristics. IEEE Transactions on Mobile Computing, 2019, 18( 8): 1745–1759

[46] Trimananda R, Varmarken J, Markopoulou A, Demsky B. Packet-level signatures for smart home devices. In: Proceedings of the Network and Distributed Systems Security (NDSS) Symposium. 2020, 1−18

[47] Campos D, OConnor T. Towards labeling on-demand IoT traffic. In: Proceedings of the 14th Cyber Security Experimentation and Test Workshop. 2021, 49−57

[48] Miettinen M, Marchal S, Hafeez I, Asokan N, Sadeghi A R, Tarkoma S. IoT sentinel: automated device-type identification for security enforcement in IoT. In: Proceedings of the 37th IEEE International Conference on Distributed Computing Systems (ICDCS). 2017, 2177−2184

[49] Bhandari G, Lyth A, Shalaginov A, Grønli T M . Distributed deep neural-network-based middleware for cyber-attacks detection in smart IoT ecosystem: a novel framework and performance evaluation approach. Electronics, 2023, 12( 2): 298

[50] Meidan Y, Bohadana M, Mathov Y, Mirsky Y, Shabtai A, Breitenbacher D, Elovici Y . N-BaIoT—network-based detection of IoT botnet attacks using deep autoencoders. IEEE Pervasive Computing, 2018, 17( 3): 12–22

[51] Huang D Y, Apthorpe N, Li F, Acar G, Feamster N . IoT inspector: crowdsourcing labeled network traffic from smart home devices at scale. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 2020, 4( 2): 46

[52] Tavallaee M, Bagheri E, Lu W, Ghorbani A A. A detailed analysis of the KDD CUP 99 data set. In: Proceedings of 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications. 2009, 1−6

[53] Moore A, Zuev D, Crogan M. Discriminators for use in flow-based classification. Technical Report, 2013

[54] Aksoy A, Gunes M H. Automated IoT device identification using network traffic. In: Proceedings of 2019 IEEE International Conference on Communications (ICC). 2019, 1−7

[55] Fan L, Zhang S, Wu Y, Wang Z, Duan C, Li J, Yang J. An IoT device identification method based on semi-supervised learning. In: Proceedings of the 16th International Conference on Network and Service Management (CNSM). 2020, 1−7

[56] Pinheiro A J, de M . Bezerra J, Burgardt C A P, Campelo D R. Identifying IoT devices and events based on packet length from encrypted traffic. Computer Communications, 2019, 144: 8–17

[57] Bai L, Yao L, Kanhere S S, Wang X, Yang Z. Automatic device classification from network traffic streams of internet of things. In: Proceedings of the 43rd IEEE Conference on Local Computer Networks (LCN). 2018, 1−9

[58] Sarker I H . Machine learning: algorithms, real-world applications and research directions. SN Computer Science, 2021, 2( 3): 160

[59] Carvalho D V, Pereira E M, Cardoso J S . Machine learning interpretability: a survey on methods and metrics. Electronics, 2019, 8( 8): 832

[60] Safavian S R, Landgrebe D . A survey of decision tree classifier methodology. IEEE Transactions on Systems, Man, and Cybernetics, 1991, 21( 3): 660–674

[61] Cortes C, Vapnik V . Support-vector networks. Machine Learning, 1995, 20( 3): 273–297

[62] Breiman L . Random forests. Machine Learning, 2001, 45( 1): 5–32

[63] Cover T, Hart P . Nearest neighbor pattern classification. IEEE Transactions on Information Theory, 1967, 13( 1): 21–27

[64] Fukushima K . Neocognitron: a self-organizing neural network model for a mechanism of pattern recognition unaffected by shift in position. Biological Cybernetics, 1980, 36( 4): 193–202

[65] Scarselli F, Gori M, Tsoi A C, Hagenbuchner M, Monfardini G . The graph neural network model. IEEE Transactions on Neural Networks, 2009, 20( 1): 61–80

[66] Lipton Z C, Berkowitz J, Elkan C. A critical review of recurrent neural networks for sequence learning. 2015, arXiv preprint arXiv: 1506.00019

[67] Hochreiter S, Schmidhuber J . Long short-term memory. Neural Computation, 1997, 9( 8): 1735–1780

[68] Sun H, Han L, Yang R, Ma X, Guo J, Zhou B. Exploit reward shifting in value-based deep-RL: optimistic curiosity-based exploration and conservative exploitation via linear reward shaping. In: Proceedings of the 36th International Conference on Neural Information Processing Systems, 2022, 2734

[69] Arulkumaran K, Deisenroth M P, Brundage M, Bharath A A. A brief survey of deep reinforcement learning. 2017, arXiv preprint arXiv: 1708.05866

[70] Mnih V, Kavukcuoglu K, Silver D, Graves A, Antonoglou I, Wierstra D, Riedmiller M. Playing Atari with deep reinforcement learning. 2013, arXiv preprint arXiv: 1312.5602

[71] Roesch M. Snort-lightweight intrusion detection for networks. In: Proceedings of the 13th USENIX Conference on System Administration. 1999, 229−238

[72] Kumar V, Sangwan O P . Signature based intrusion detection system using snort. International Journal of Computer Applications & Information Technology, 2012, 1( 3): 35–41

[73] Feng X, Li Q, Wang H, Sun L. Acquisitional rule-based engine for discovering internet-of-thing devices. In: Proceedings of the 27th USENIX Security Symposium. 2018, 327−341

[74] Bremler-Barr A, Levy H, Yakhini Z. IoT or NoT: Identifying IoT devices in a short time scale. In: Proceedings of 2020 IEEE/IFIP Network Operations and Management Symposium. 2020, 1−9

[75] Le F, Ortiz J, Verma D, Kandlur D. Policy-based identification of IoT devices’ vendor and type by DNS traffic analysis. In: Calo S, Bertino E, Verma D, eds. Policy-Based Autonomic Data Governance. Cham: Springer, 2019, 180−201

[76] Prakash V, Xie S, Huang D Y. Inferring software update practices on smart home IoT devices through user agent analysis. In: Proceedings of 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses. 2022, 93−103

[77] Babun L, Aksu H, Ryan L, Akkaya K, Bentley E S, Uluagac A S. Z-IoT: passive device-class fingerprinting of ZigBee and Z-wave IoT devices. In: Proceedings of 2020 IEEE International Conference on Communications (ICC). 2020, 1−7

[78] Ma X, Qu J, Li J, Lui J C S, Li Z, Liu W, Guan X . Inferring hidden IoT devices and user interactions via spatial-temporal traffic fingerprinting. IEEE/ACM Transactions on Networking, 2022, 30( 1): 394–408

[79] Kostas K, Just M, Lones M A . IoTDevID: a behavior-based device identification method for the IoT. IEEE Internet of Things Journal, 2022, 9( 23): 23741–23749

[80] Aksu H, Uluagac A S, Bentley E S . Identification of wearable devices with Bluetooth. IEEE Transactions on Sustainable Computing, 2021, 6( 2): 221–230

[81] Varmarken J, Al Aaraj J, Trimananda R, Markopoulou A . FingerprinTV: fingerprinting smart TV apps. Proceedings on Privacy Enhancing Technologies, 2022, 2022( 3): 606–629

[82] Sivanathan A, Sherratt D, Gharakheili H H, Radford A, Wijenayake C, Vishwanath A, Sivaraman V. Characterizing and classifying IoT traffic in smart cities and campuses. In: Proceedings of 2017 IEEE Conference on Computer Communications Workshops. 2017, 559−564

[83] Marchal S, Miettinen M, Nguyen T D, Sadeghi A R, Asokan N . Audi: toward autonomous IoT device-type identification using periodic communication. IEEE Journal on Selected Areas in Communications, 2019, 37( 6): 1402–1412

[84] Guo H, Heidemann J. IP-based IoT device detection. In: Proceedings of 2018 Workshop on IoT Security and Privacy. 2018, 36−42

[85] Saidi S J, Mandalari A M, Kolcun R, Haddadi H, Dubois D J, Choffnes D, Smaragdakis G, Feldmann A. A haystack full of needles: scalable detection of IoT devices in the wild. In: Proceedings of the ACM Internet Measurement Conference. 2020, 87−100

[86] Yu L, Luo B, Ma J, Zhou Z, Liu Q. You are what you broadcast: identification of mobile and IoT devices from (public) WiFi. In: Proceedings of the 29th USENIX Security Symposium. 2020, 55−72

[87] Dong S, Li Z, Tang D, Chen J, Sun M, Zhang K. Your smart home can’t keep a secret: towards automated fingerprinting of IoT traffic. In: Proceedings of the 15th ACM Asia Conference on Computer and Communications Security. 2020, 47−59

[88] Maiti R R, Siby S, Sridharan R, Tippenhauer N O. Link-layer device type classification on encrypted wireless traffic with cots radios. In: Foley S N, Gollmann D, Snekkenes E, eds. Computer Security −ESORICS 2017. Cham: Springer, 2017, 247−264

[89] Santos M R P, Andrade R M C, Gomes D G, Callado A C. An efficient approach for device identification and traffic classification in IoT ecosystems. In: Proceedings of 2018 IEEE Symposium on Computers and Communications (ISCC). 2018, 304−309

[90] Wanode S S, Anand M, Mitra B. Optimal feature set selection for IoT device fingerprinting on edge infrastructure using machine intelligence. In: Proceedings of 2022 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). 2022, 1−6

[91] Chakraborty B, Divakaran D M, Nevat I, Peters G W, Gurusamy M . Cost-aware feature selection for IoT device classification. IEEE Internet of Things Journal, 2021, 8( 14): 11052–11064

[92] Du R, Wang J, Li S . A lightweight flow feature-based IoT device identification scheme. Security and Communication Networks, 2022, 2022( 1): 8486080

[93] Meidan Y, Bohadana M, Shabtai A, Guarnizo J D, Ochoa M, Tippenhauer N O, Elovici Y. ProfilioT: a machine learning approach for IoT device identification based on network traffic analysis. In: Proceedings of the Symposium on Applied Computing. 2017, 506−509

[94] Ammar N, Noirie L, Tixeuil S. Autonomous identification of IoT device types based on a supervised classification. In: Proceedings of 2020 IEEE International Conference on Communications (ICC). 2020, 1−6

[95] Msadek N, Soua R, Engel T. IoT device fingerprinting: machine learning based encrypted traffic analysis. In: Proceedings of 2019 IEEE Wireless Communications and Networking Conference (WCNC). 2019, 1−8

[96] Ortiz J, Crawford C, Le F. DeviceMien: network device behavior modeling for identifying unknown IoT devices. In: Proceedings of the International Conference on Internet of Things Design and Implementation. 2019, 106−117

[97] Thangavelu V, Divakaran D M, Sairam R, Bhunia S S, Gurusamy M . Deft: a distributed IoT fingerprinting technique. IEEE Internet of Things Journal, 2019, 6( 1): 940–952

[98] Guo H, Heidemann J . Detecting IoT devices in the internet. IEEE/ACM Transactions on Networking, 2020, 28( 5): 2323–2336

[99] Apthorpe N, Reisman D, Sundaresan S, Narayanan A, Feamster N. Spying on the smart home: privacy attacks and defenses on encrypted IoT traffic. 2017, arXiv preprint arXiv: 1708.05044

[100] Apthorpe N, Reisman D, Feamster N. A smart home is no castle: privacy vulnerabilities of encrypted IoT traffic. 2017, arXiv preprint arXiv: 1705.06805

[101] OConnor T, Mohamed R, Miettinen M, Enck W, Reaves B, Sadeghi A R. HomeSnitch: behavior transparency and control for smart home IoT devices. In: Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks. 2019, 128−138

[102] Charyyev B, Gunes M H. IoT event classification based on network traffic. In: Proceedings of 2020 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). 2020, 854−859

[103] Duan C, Zhang S, Yang J, Wang Z, Yang Y, Li J. PINBALL: universal and robust signature extraction for smart home devices. In: Proceedings of 2021 IFIP/IEEE International Symposium on Integrated Network Management (IM). 2021, 1−9

[104] Wan Y, Xu K, Wang F, Xue G . Iotathena: unveiling IoT device activities from network traffic. IEEE Transactions on Wireless Communications, 2022, 21( 1): 651–664

[105] Acar A, Fereidooni H, Abera T, Sikder A K, Miettinen M, Aksu H, Conti M, Sadeghi A R, Uluagac S. Peek-a-boo: i see your smart home activities, even encrypted! In: Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks. 2020, 207−218

[106] Shafqat N, Dubois D J, Choffnes D, Schulman A, Bharadia D, Ranganathan A. ZLeaks: passive inference attacks on Zigbee based smart homes. In: Proceedings of the 20th International Conference on Applied Cryptography and Network Security. 2022, 105−125

[107] Gu T, Fang Z, Abhishek A, Fu H, Hu P, Mohapatra P. IoTGaze: IoT security enforcement via wireless context analysis. In: Proceedings of 2020 IEEE Conference on Computer Communications. 2020, 884−893

[108] Ahmed D, Sabir A, Das A. Spying through your voice assistants: realistic voice command fingerprinting. In: Proceedings of the 32nd USENIX Security Symposium. 2023, 2419−2436

[109] Singh A D, Garcia L, Noor J, Srivastava M. I always feel like somebody’s sensing me! A framework to detect, identify, and localize clandestine wireless sensors. In: Proceedings of the 30th USENIX Security Symposium. 2021, 1829−1846

[110] Li H, He Y, Sun L, Cheng X, Yu J. Side-channel information leakage of encrypted video stream in video surveillance systems. In: Proceedings of the 35th Annual IEEE International Conference on Computer Communications. 2016, 1−9

[111] Cheng Y, Ji X, Lu T, Xu W. DeWiCam: detecting hidden wireless cameras via smartphones. In: Proceedings of 2018 Asia Conference on Computer and Communications Security. 2018, 1−13

[112] Wu K, Lagesse B. Do you see what I see? Detecting hidden streaming cameras through similarity of simultaneous observation. In: Proceedings of 2019 IEEE International Conference on Pervasive Computing and Communications (PerCom. 2019, 1−10

[113] Sharma R A, Soltanaghaei E, Rowe A, Sekar V. Lumos: identifying and localizing diverse hidden IoT devices in an unfamiliar environment. In: Proceedings of the 31st USENIX Security Symposium. 2022, 1095−1112

[114] Shi L, Bahl P, Katabi D. Beyond sensing: multi-GHz realtime spectrum analytics. In: Proceedings of the 12th USENIX Conference on Networked Systems Design and Implementation. 2015, 159−172

[115] Felten E W, Schneider M A. Timing attacks on Web privacy. In: Proceedings of the 7th ACM Conference on Computer and Communications Security. 2000, 25−32

[116] Conti M, Mancini L V, Spolaor R, Verde N V . Analyzing android encrypted network traffic to identify user actions. IEEE Transactions on Information Forensics and Security, 2016, 11( 1): 114–125

[117] Pathmaperuma M H, Rahulamathavan Y, Dogan S, Kondoz A M. User mobile app encrypted activity detection. In: Proceedings of the 2nd European Symposium on Computer and Communications. 2021, 7−13

[118] Wan Y, Xu K, Wang F, Xue G. IoTMosaic: inferring user activities from IoT network traffic in smart homes. In: Proceedings of 2022 IEEE Conference on Computer Communications. 2022, 370−379

[119] Gu T, Fang Z, Abhishek A, Mohapatra P. IoTSpy: uncovering human privacy leakage in IoT networks via mining wireless context. In: Proceedings of the 1st IEEE Annual International Symposium on Personal, Indoor and Mobile Radio Communications. 2020, 1−7

[120] Subahi A, Theodorakopoulos G . Detecting IoT user behavior and sensitive information in encrypted IoT-app traffic. Sensors, 2019, 19( 21): 4777

[121] Chu G, Apthorpe N, Feamster N . Security and privacy analyses of internet of things children’s toys. IEEE Internet of Things Journal, 2019, 6( 1): 978–985

[122] Schmidt D, Tagliaro C, Borgolte K, Lindorfer M. IoTFlow: inferring IoT device behavior at scale through static mobile companion app analysis. In: Proceedings of 2023 ACM SIGSAC Conference on Computer and Communications Security. 2023, 681−695

[123] Babun L, Celik Z B, McDaniel P, Uluagac A S . Real-time analysis of privacy-(un)aware IoT applications. Proceedings on Privacy Enhancing Technologies Symposium, 2021, 2021( 1): 145–166

[124] Prasad R, Rohokale V. Cyber threats and attack overview. In: Prasad R, Rohokale V, eds. Cyber Security: The Lifeline of Information and Communication Technology. Cham: Springer, 2020, 15−31

[125] Anthi E, Williams L, Słowinska M, Theodorakopoulos G, Burnap P . A supervised intrusion detection system for smart home IoT devices. IEEE Internet of Things Journal, 2019, 6( 5): 9042–9053

[126] Charyyev B, Gunes M H. Detecting anomalous IoT traffic flow with locality sensitive hashes. In: Proceedings of 2020 IEEE Global Communications Conference. 2020, 1−6

[127] Wu J, Nan Y, Kumar V, Payer M, Xu D. BlueShield: detecting spoofing attacks in Bluetooth low energy networks. In: Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses. 2020, 397−411

[128] Tekiner E, Acar A, Uluagac A S. A lightweight IoT cryptojacking detection mechanism in heterogeneous smart home networks. In: Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS). 2022, 1−15

[129] Pathak A K, Saguna S, Mitra K, Åhlund C. Anomaly detection using machine learning to discover sensor tampering in IoT systems. In: Proceedings of 2021 IEEE International Conference on Communications. 2021, 1−6

[130] Zhang W, Meng Y, Liu Y, Zhang X, Zhang Y, Zhu H. HoMonit: monitoring smart home apps from encrypted traffic. In: Proceedings of 2018 ACM SIGSAC Conference on Computer and Communications Security. 2018, 1074−1088

[131] Wan Y, Xu K, Xue G, Wang F. IoTArgos: a multi-layer security monitoring system for internet-of-things in smart homes. In: Proceedings of 2020 IEEE Conference on Computer Communications. 2020, 874−883

[132] Heartfield R, Loukas G, Bezemskij A, Panaousis E . Selfconfigurable cyber-physical intrusion detection for smart homes using reinforcement learning. IEEE Transactions on Information Forensics and Security, 2021, 16: 1720–1735

[133] Antonakakis M, April T, Bailey M, Bernhard M, Bursztein E, Cochran J, Durumeric Z, Halderman J A, Invernizzi L, Kallitsis M, Kumar D, Lever C, Ma Z, Mason J, Menscher D, Seaman C, Sullivan N, Thomas K, Zhou Y. Understanding the Mirai botnet. In: Proceedings of the 26th USENIX Security Symposium. 2017, 1093−1110

[134] Okur C, Dener M. Detecting IoT botnet attacks using machine learning methods. In: Proceedings of 2020 International Conference on Information Security and Cryptology (ISCTURKEY). 2020, 31−37

[135] Dwyer O P, Marnerides A K, Giotsas V, Mursch T. Profiling IoT-based botnet traffic using DNS. In: Proceedings of 2019 IEEE Global Communications Conference (GLOBECOM). 2019, 1−6

[136] Shafiq M, Tian Z, Bashir A K, Du X, Guizani M . CorrAUC: a malicious bot-IoT traffic detection method in IoT network using machine-learning techniques. IEEE Internet of Things Journal, 2021, 8( 5): 3242–3254

[137] Doshi K, Yilmaz Y, Uludag S . Timely detection and mitigation of stealthy DDoS attacks via IoT networks. IEEE Transactions on Dependable and Secure Computing, 2021, 18( 5): 2164–2176

[138] Torabi S, Bou-Harb E, Assi C, Karbab E B, Boukhtouta A, Debbabi M . Inferring and investigating IoT-generated scanning campaigns targeting a large network telescope. IEEE Transactions on Dependable and Secure Computing, 2022, 19( 1): 402–418

[139] Hwang R H, Peng M C, Huang C W. Detecting IoT malicious traffic based on autoencoder and convolutional neural network. In: Proceedings of 2019 IEEE Globecom Workshops (GC Wkshps). 2019, 1−6

[140] Nakip M, Gelenbe E. MIRAI botnet attack detection with auto-associative dense random neural network. In: Proceedings of 2021 IEEE Global Communications Conference (GLOBECOM). 2021, 1−6

[141] Kim J, Sim A, Kim J, Wu K. Botnet detection using Recurrent Variational Autoencoder. In: Proceedings of 2020 IEEE Global Communications Conference. 2020, 1−6

[142] Nguyen T D, Marchal S, Miettinen M, Fereidooni H, Asokan N, Sadeghi A R. DÏoT: a federated self-learning anomaly detection system for IoT. In: Proceedings of the 39th IEEE International Conference on Distributed Computing Systems (ICDCS). 2019, 756−767

[143] Nishio T, Nakahara M, Okui N, Kubota A, Kobayashi Y, Sugiyama K, Shinkuma R. Anomaly traffic detection with federated learning toward network-based malware detection in IoT. In: Proceedings of 2022 IEEE Global Communications Conference. 2022, 299−304

[144] Zhao R, Yang L, Wang Y, Xue Z, Gui G, Ohtsuki T. A semi-supervised federated learning scheme via knowledge distillation for intrusion detection. In: Proceedings of 2022 IEEE International Conference on Communications. 2022, 2688−2693

[145] Elghalhoud O, Naik K, Zaman M, S R M. Data balancing and CNN based network intrusion detection system. In: Proceedings of 2023 IEEE Wireless Communications and Networking Conference (WCNC). 2023, 1−6

[146] Zhang J, Liang S, Ye F, Hu R Q, Qian Y. Towards detection of zero-day botnet attack in IoT networks using federated learning. In: Proceedings of 2023 IEEE International Conference on Communications. 2023, 7−12

[147] Popoola S I, Ande R, Adebisi B, Gui G, Hammoudeh M, Jogunola O . Federated deep learning for zero-day botnet attack detection in IoT-edge devices. IEEE Internet of Things Journal, 2022, 9( 5): 3930–3944

[148] Luo Y, Chen X, Ge N, Feng W, Lu J. Transformer-based malicious traffic detection for internet of things. In: Proceedings of 2022 IEEE International Conference on Communications. 2022, 4187−4192

[149] Bovenzi G, Aceto G, Ciuonzo D, Persico V, Pescapé A. A hierarchical hybrid intrusion detection approach in IoT scenarios. In: Proceedings of 2020 IEEE Global Communications Conference. 2020, 1−7

[150] Zixu T, Liyanage K S K, Gurusamy M. Generative adversarial network and auto encoder based anomaly detection in distributed IoT networks. In: Proceedings of 2020 IEEE Global Communications Conference. 2020, 1−7

[151] Popoola S I, Adebisi B, Hammoudeh M, Gui G, Gacanin H . Hybrid deep learning for botnet attack detection in the internet-of-things networks. IEEE Internet of Things Journal, 2021, 8( 6): 4944–4956

[152] Dinh P V, Uy N Q, Nguyen D N, Hoang D T, Bao S P, Dutkiewicz E. Twin Variational Auto-Encoder for representation learning in IoT intrusion detection. In: Proceedings of 2022 IEEE Wireless Communications and Networking Conference (WCNC). 2022, 848−853

[153] Baby R, Pooranian Z, Shojafar M, Tafazolli R. A heterogenous IoT attack detection through deep reinforcement learning: a dynamic ml approach. In: Proceedings of 2023 IEEE International Conference on Communications. 2023, 479−484

[154] Reed A, Dooley L S, Mostefaoui S K. A reliable real-time slow dos detection framework for resource-constrained IoT networks. In: Proceedings of 2021 IEEE Global Communications Conference (GLOBECOM). 2021, 1−6

[155] Pineda D, Harrilal-Parchment R, Akkaya K, Perez-Pons A. SDN-based GTP-U traffic analysis for 5G networks. In: Proceedings of the NOMS 2023−2023 IEEE/IFIP Network Operations and Management Symposium. 2023, 1−4

[156] Kumar D, Shen K, Case B, Garg D, Alperovich G, Kuznetsov D, Gupta R, Durumeric Z. All things considered: an analysis of IoT devices on home networks. In: Proceedings of the 28th USENIX Conference on Security Symposium. 2019, 1169−1185

[157] Paracha M T, Dubois D J, Vallina-Rodriguez N, Choffnes D. IoTLS: understanding TLS usage in consumer IoT devices. In: Proceedings of the 21st ACM Internet Measurement Conference. 2021, 165−178

[158] Saidi S J, Matic S, Gasser O, Smaragdakis G, Feldmann A. Deep dive into the IoT backend ecosystem. In: Proceedings of the 22nd ACM Internet Measurement Conference. 2022, 488−503

[159] Tagliaro C, Komsic M, Continella A, Borgolte K, Lindorfer M. Large-scale security analysis of real-world backend deployments speaking IoT-focused protocols. In: Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses. 2024, 561−578

[160] Hasan N, Chen Z, Zhao C, Zhu Y, Liu C. IoT botnet detection framework from network behavior based on extreme learning machine. In: Proceedings of 2022 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). 2022, 1−6

[161] Illy P, Kaddoum G, Moreira C M, Kaur K, Garg S. Securing fog-to-things environment using intrusion detection system based on ensemble learning. In: Proceedings of 2019 IEEE Wireless Communications and Networking Conference (WCNC). 2019, 1−7

[162] Hafeez I, Antikainen M, Ding A Y, Tarkoma S . IoT-keeper: detecting malicious IoT network activity using online traffic analysis at the edge. IEEE Transactions on Network and Service Management, 2020, 17( 1): 45–59

[163] Wang H, Muñoz-González L, Eklund D, Raza S. Non-IID data re-balancing at IoT edge with peer-to-peer federated learning for anomaly detection. In: Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks. 2021, 153−163

[164] Zhou K, Lin X, Wu J, Bashir A K, Li J, Imran M. Metric learning-based few-shot malicious node detection for IoT backhaul/fronthaul networks. In: Proceedings of 2022 IEEE Global Communications Conference. 2022, 5777−5782

[165] Herwig S, Harvey K, Hughey G, Roberts R, Levin D. Measurement and analysis of Hajime, a peer-to-peer IoT botnet. In: Proceedings of the Network and Distributed Systems Security (NDSS) Symposium. 2019

[166] Noroozian A, Rodriguez E T, Lastdrager E, Kasama T, Van Eeten M, Gañán C H. Can ISPs help mitigate IoT malware? A longitudinal study of broadband ISP security efforts. In: Proceedings of 2021 IEEE European Symposium on Security and Privacy (EuroS&P). 2021, 337−352

[167] Almazarqi H A, Woodyard M, Mursch T, Pezaros D, Marnerides A K. Macroscopic analysis of IoT botnets. In: Proceedings of 2022 IEEE Global Communications Conference. 2022, 2674−2679

[168] Dubois D J, Kolcun R, Mandalari A M, Paracha M T, Choffnes D, Haddadi H . When speakers are all ears: characterizing misactivations of IoT smart speakers. Proceedings on Privacy Enhancing Technologies Symposium, 2020, 2020( 4): 255–276

[169] Li J, Li Z, Tyson G, Xie G. Your privilege gives your privacy away: an analysis of a home security camera service. In: Proceedings of 2020 IEEE Conference on Computer Communications. 2020, 387−396

[170] Mandalari A M, Dubois D J, Kolcun R, Paracha M T, Haddadi H, Choffnes D . Blocking without breaking: identification and mitigation of non-essential IoT traffic. Proceedings on Privacy Enhancing Technologies Symposium, 2021, 2021( 4): 369–388

[171] Kowalczyk M, Gunawan J T, Choffnes D, Dubois D J, Hartzog W, Wilson C. Understanding dark patterns in home IoT devices. In: Proceedings of 2023 CHI Conference on Human Factors in Computing Systems. 2023, 179

[172] Mandalari A M, Haddadi H, Dubois D J, Choffnes D. Protected or porous: a comparative analysis of threat detection capability of IoT safeguards. In: Proceedings of 2023 IEEE Symposium on Security and Privacy. 2023, 3061−3078

[173] Shenoi A, Vairam P K, Sabharwal K, Li J, Divakaran D M . iPET: privacy enhancing traffic perturbations for secure IoT communications. Proceedings on Privacy Enhancing Technologies, 2023, 2023( 2): 206–220

[174] Apthorpe N, Huang D Y, Reisman D, Narayanan A, Feamster N . Keeping the smart home private with smart(er) IoT traffic shaping. Proceedings on Privacy Enhancing Technologies, 2019, 2019( 3): 128–148

[175] Shmatikov V, Wang M H. Timing analysis in low-latency mix networks: attacks and defenses. In: Proceedings of the 11th European Symposium on Research in Computer Security. 2006, 18−33

[176] Brahma J, Sadhya D . Preserving contextual privacy for smart home IoT devices with dynamic traffic shaping. IEEE Internet of Things Journal, 2022, 9( 13): 11434–11441

[177] Hou T, Wang T, Lu Z, Liu Y, Sagduyu Y. IoTGAN: GAN powered camouflage against machine learning based IoT device identification. In: Proceedings of 2021 IEEE International Symposium on Dynamic Spectrum Access Networks (DySPAN). 2021, 280−287

[178] Tan S, Yu S, Liu W, He D, Chan S . You can glimpse but you cannot identify: protect IoT devices from being fingerprinted. IEEE Transactions on Dependable and Secure Computing, 2024, 21( 3): 1210–1223

[179] Han D, Wang Z, Zhong Y, Chen W, Yang J, Lu S, Shi X, Yin X . Evaluating and improving adversarial robustness of machine learning-based network intrusion detectors. IEEE Journal on Selected Areas in Communications, 2021, 39( 8): 2632–2647

[180] Qiu H, Dong T, Zhang T, Lu J, Memmi G, Qiu M . Adversarial attacks against network intrusion detection in IoT systems. IEEE Internet of Things Journal, 2021, 8( 13): 10327–10335

[181] Liu J, Zhang C, Fang Y . EPIC: a differential privacy framework to defend smart homes against internet traffic analysis. IEEE Internet of Things Journal, 2018, 5( 2): 1206–1217

[182] Duan C, Wang K, Chen W, Song G, Yang J, Wang Z. Monitoring smart home traffic under differential privacy. In: Proceedings of the NOMS 2022−2022 IEEE/IFIP Network Operations and Management Symposium. 2022, 1−10

[183] Xiong S, Sarwate A D, Mandayam N B . Network traffic shaping for enhancing privacy in IoT systems. IEEE/ACM Transactions on Networking, 2022, 30( 3): 1162–1177

[184] Alomari E, Manickam S, Gupta B B, Singh P, Anbar M. Design, deployment and use of HTTP-based botnet (HBB) testbed. In: Proceedings of the 16th International Conference on Advanced Communication Technology. 2014, 1265−1269

[185] Lee C, Abe H, Hirotsu T, Umemura K . Traffic anomaly analysis and characteristics on a virtualized network testbed. IEICE Transactions on Information and Systems, 2011, E94-D( 12): 2353–2361

[186] Catillo M, Pecchia A, Villano U. Machine learning on public intrusion datasets: academic hype or concrete advances in NIDS? In: Proceedings of the 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks-Supplemental Volume (DSN-S). 2023, 132−136

[187] Xie R, Wang Y, Cao J, Dong E, Xu M, Sun K, Li Q, Shen L, Zhang M. Rosetta: enabling robust TLS encrypted traffic classification in diverse network environments with TCP-aware traffic augmentation. In: Proceedings of the ACM Turing Award Celebration Conference-China 2023. 2023, 131−132

[188] Bronzino F, Schmitt P, Ayoubi S, Kim H, Teixeira R, Feamster N . Traffic refinery: cost-aware data representation for machine learning on network traffic. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 2021, 5( 3): 40

[189] Zola F, Segurola-Gil L, Bruse J L, Galar M, Orduna-Urrutia R . Network traffic analysis through node behaviour classification: a graph-based approach with temporal dissection and data-level preprocessing. Computers & Security, 2022, 115: 102632

[190] Holland J, Schmitt P, Feamster N, Mittal P. New directions in automated traffic analysis. In: Proceedings of 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021, 3366−3383

[191] Kaddour J, Harris J, Mozes M, Bradley H, Raileanu R, McHardy R. Challenges and applications of large language models. 2023, arXiv preprint arXiv: 2307.10169

[192] Sarabi A, Yin T, Liu M. An LLM-based framework for fingerprinting internet-connected devices. In: Proceedings of 2023 ACM on Internet Measurement Conference. 2023, 478−484

[193] Habib M A, Rivera P E I, Ozcan Y, Elsayed M, Bavand M, Gaigalas R, Erol-Kantarci M. LLM-based intent processing and network optimization using attention-based hierarchical reinforcement learning. In: Proceedings of 2025 IEEE Wireless Communications and Networking Conference (WCNC). 2025, 1−6

[194] Guastalla M, Li Y, Hekmati A, Krishnamachari B. Application of large language models to DDoS attack detection. In: Proceedings of the 1st EAI International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles. 2023, 83−99

[195] Hassanin M, Keshk M, Salim S, Alsubaie M, Sharma D . PLLM-CS: pre-trained large language model (LLM) for cyber threat detection in satellite networks. Ad Hoc Networks, 2025, 166: 103645

[196] Qiao C, Li M, Liu Y, Tian Z . Transitioning from federated learning to quantum federated learning in internet of things: a comprehensive survey. IEEE Communications Surveys & Tutorials, 2025, 27( 1): 509–545

[197] Qiao C, Brown K N, Zhang F, Tian Z . Adaptive asynchronous clustering algorithms for wireless mesh networks. IEEE Transactions on Knowledge and Data Engineering, 2023, 35( 3): 2610–2627

[198] Zhao B, Ji S, Xu J, Tian Y, Wei Q, Wang Q, Lyu C, Zhang X, Lin C, Wu J, Beyah R. A large-scale empirical analysis of the vulnerabilities introduced by third-party components in IoT firmware. In: Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. 2022, 442−454

[199] Nan Y, Wang X, Xing L, Liao X, Wu R, Wu J, Zhang Y, Wang X. Are you spying on me?: large-scale analysis on IoT data exposure through companion apps. In: Proceedings of the 32nd USENIX Conference on Security Symposium. 2023, 373

[200] Chen J, Diao W, Zhao Q, Zuo C, Lin Z, Wang X, Lau W C, Sun M, Yang R, Zhang K. IoTFuzzer: discovering memory corruptions in IoT through app-based fuzzing. In: Proceedings of the 25th Annual Network and Distributed System Security Symposium. 2018, 1−15

[201] Cobb C, Surbatovich M, Kawakami A, Sharif M, Bauer L, Das A, Jia L. How risky are real users’ IFTTT applets? In: Proceedings of the 16th Symposium on Usable Privacy and Security. 2020, 505−529

[202] Bastys I, Balliu M, Sabelfeld A. If this then what?: controlling flows in IoT apps. In: Proceedings of 2018 ACM SIGSAC Conference on Computer and Communications Security. 2018, 1102−1119

[203] Jia Y, Xiao Y, Yu J, Cheng X, Liang Z, Wan Z. A novel graph-based mechanism for identifying traffic vulnerabilities in smart home IoT. In: Proceedings of 2018 IEEE Conference on Computer Communications. 2018, 1493−1501

[204] Peng C, Fan W, Huang W, Zhu D. A novel approach based on improved naive Bayes for 5G air interface DDoS detection. In: Proceedings of 2023 IEEE Wireless Communications and Networking Conference (WCNC). 2023, 1−6

[205] Arefin S, Chowdhury M, Parvez R, Ahmed T, Abrar A F M S, Sumaiya F. Understanding APT detection using machine learning algorithms: is superior accuracy a thing? In: Proceedings of 2024 IEEE International Conference on Electro Information Technology (eIT). 2024, 532−537

[206] Chen J, Lan X, Zhang Q, Ma W, Fang W, He J. Defending against apt attacks in cloud computing environments using grouped multi-agent deep reinforcement learning. IEEE Internet of Things Journal, 2025

RIGHTS & PERMISSIONS

Higher Education Press