A Network Device Identification Method Based on Packet Temporal Features and Machine Learning

Lin Hu, Baoqi Zhao, Guangji Wang

With the rapid development of the Internet of Things (IoT) technology, the number and types of devices accessing the Internet are increasing, leading to increased network security problems such as hacker attacks and botnets. Usually, these attacks are related to the type of device, and the risk can be effectively reduced if the type of network device can be efficiently identified and controlled. The traditional network device identification method uses active detection technology to obtain information about the device and match it with a manually defined fingerprint database to achieve network device identification. This method impacts the smoothness of the network and requires the manual establishment of fingerprint libraries, which imposes a large labor cost but only achieves a low identification efficiency. The traditional machine learning method only considers the information of individual packets; it does not consider the timing relationship between packets, and the recognition effect is poor. Based on the above research, in this paper, we considered the packet temporal relationship, proposed the TCN model of the Inception structure, extracted the packet temporal relationship, and designed a multi-head self-attention mechanism to fuse the features to generate device fingerprints for device identification. Experiments were conducted on the publicly available UNSW dataset, and the results showed that this method achieved notable improvements compared to the traditional machine learning method, with F1 reaching 96.76%.