Robust Lightweight IoT Device Fingerprinting Under Network Traffic Anomalies

Roya Taheri; Shamik Sengupta

cs.NIOct 19, 2026

Robust Lightweight IoT Device Fingerprinting Under Network Traffic Anomalies

Authors: Roya Taheri, Shamik Sengupta

Organizations: Department of Computer Science and Engineering, University of Nevada, Reno, USA

Abstract

Accurate IoT device identification is essential for network security, yet many existing approaches rely on payload inspection, feature engineering, or long observation windows that limit scalability and often assume stable network conditions despite the inherent variability of real-world IoT traffic. We propose a lightweight IoT device identification approach based on packet headers and locality-sensitive hashing (LSH), generating compact fingerprint representations at packet- and window-level granularities. To evaluate robustness, we consider packet-level traffic anomalies including drop, perturbation, reordering, duplication, and packet injection. Experimental results show that the proposed approach achieves up to 99% accuracy while maintaining robustness under realistic traffic distortions using short bounded observation windows. Anomalies affecting global traffic structure produce the largest performance degradation, whereas window-level representations improve robustness by reducing sensitivity to localized distortions. The low computational overhead of the proposed approach enables scalable IoT device identification in resource-constrained environments.

Figures & tables

Figure 1: Overview of the proposed device fingerprinting

Anomaly	Ratio	W=1	W=5	W=10	W=20
Reordering	0.5	0.220	0.171	0.144	0.120
Perturbation	0.5	0.230	0.185	0.158	0.132
Injection	0.5	0.231	0.188	0.162	0.141

Table I : Average normalized Hamming distance between clean and anomalous fingerprints across window sizes.

Model	W=1	W=5	W=10	W=20
LogReg	0.969 $\pm$ 0.001	0.990 $\pm$ 0.002	0.994 $\pm$ 0.002	0.999 $\pm$ 0.002
MLP	0.980 $\pm$ 0.001	0.991 $\pm$ 0.001	0.994 $\pm$ 0.001	0.998 $\pm$ 0.001
RF	0.977 $\pm$ 0.001	0.983 $\pm$ 0.001	0.989 $\pm$ 0.001	0.993 $\pm$ 0.002
SVM	0.972 $\pm$ 0.002	0.986 $\pm$ 0.002	0.993 $\pm$ 0.001	0.999 $\pm$ 0.001

Table II : Average Classification Accuracy (Mean

\pm

Std) under Different Window Sizes (No Anomaly)

Panel of Figure 3 — Figure 3: Classification accuracy versus traffic anomaly ratio for different anomalies using the RF classifier. Injection causes the most significant degradation, while larger window sizes maintain higher accuracy.

Figure 4: Classification accuracy under combined perturbation and injection ratios using RF classifier.

Figure 5: Per-device precision for selected devices using the RF classifier under injection-based traffic anomalies averaged across all injection ratios for packet-level and window-level fingerprint representations.

Window	Time (ms)	Memory (B)
W=1	$0.91\pm 0.54$	$913\pm 287$
W=5	$3.76\pm 2.31$	$938\pm 246$
W=10	$7.34\pm 4.34$	$953\pm 225$
W=20	$14.34\pm 8.20$	$934\pm 154$

Table III : Fingerprinting overhead across window sizes.

Model	Latency (ms)	Runtime Memory (MB)
LogReg	0.06	349
MLP	0.10	353
RF	4.01	393
SVM	0.06	353

Table IV : Inference overhead per fingerprint representation.

Method	Features	Eval.	Obs.	Acc.
IoT Sentinel [ 4 ]	Statistical	No	Setup	95%
LSIF [ 23 ]	LSH+Similarity	No	Flows	90–93%
SmartRecon [ 25 ]	LSH+Neural	No	Limited	94%
Proposed	Header-LSH+ML	Yes	Limited	99%

Table V : Comparison with existing IoT fingerprinting approaches.

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 355 papers

In-network Attack Detection with Federated Deep Learning in IoT Networks: Real Implementation and Analysis
Mar 23, 2026Devashish Chaudhary, Sutharshan Rajasegarar, Shiva Raj Pokhrel +2IoT Intrusion Detection Network Intrusion Detection
School of IT, Deakin University, Geelong, Australia · School of Computer Science and Engineering, Vellore Institute of Technology, Vellore, India
What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale
Sep 24, 2025Rameen Mahmood, Tousif Ahmed, Sai Teja Peddinti +1Internet of Things LLMs for Cybersecurity
New York University, New York, NY, USA · Google, Mountain View, CA, USA
Deep learning based intelligent IDS for Large-scale IoT networks
Mar 17, 2026Isha Andrade, Shalaka S Mahadik, Mithun Mukherjee +2IoT Intrusion Detection Network Intrusion Detection
Department of Computer Science, Birla Institute of Technology and Science, Pilani, Dubai Campus, Dubai International Academic City, Dubai, United Arab Emirates

Mar 23, 2026J/K move · Enter open · S save

In-network Attack Detection with Federated Deep Learning in IoT Networks: Real Implementation and Analysis

Devashish Chaudhary, Sutharshan Rajasegarar, Shiva Raj Pokhrel, Lei Pan+1

School of IT, Deakin University, Geelong, Australia · School of Computer Science and Engineering, Vellore Institute of Technology, Vellore, India

IoT Intrusion Detection Network Intrusion Detection Reconstruction-Based Anomaly Detection Federated Learning

Open paper AskPDF arXiv

The rapid expansion of the Internet of Things (IoT) and its integration with backbone networks have heightened the risk of security breaches. Traditional centralized approaches to anomaly detection, which require transferring large volumes of data to central servers, suffer from privacy, scalability, and latency limitations. This paper proposes a lightweight autoencoder-based anomaly detection framework designed for deployment on resource-constrained edge devices, enabling real-time detection while minimizing data transfer and preserving privacy. Federated learning is employed to train models collaboratively across distributed devices, where local training occurs on edge nodes and only model weights are aggregated at a central server. A real-world IoT testbed using Raspberry Pi sensor nodes was developed to collect normal and attack traffic data. The proposed federated anomaly detection system, implemented and evaluated on the testbed, demonstrates its effectiveness in accurately identifying network attacks. The communication overhead was reduced significantly while achieving comparable performance to the centralized method.

Abstract

Cybersecurity

Explore similar work

In-network Attack Detection with Federated Deep Learning in IoT Networks: Real Implementation and Analysis

What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale

Deep learning based intelligent IDS for Large-scale IoT networks