We now present our observations using passive packet- level analysis of traffic from 28 IoT devices over the course of 26 weeks. We study a broad range of IoT traffic char- acteristics including activity patterns (e.g. distribution of volume/times during active/sleep periods), and signalling (e.g. domain names requested, server-side port numbers used and TLS handshake exchanges).
To get in-depth knowledge on IoT, you can enroll for live IoT online training by OnlineITGuru with 24/7 support and lifetime access
IoT traffic constitutes (i) traffic generated by the devices autonomously – e.g. DNS, NTP, etc. that are unaffected by human interaction, as well as (ii) traffic generated due to users interacting with the devices – e.g. Belkin Wemo sensor responding to detection of movement, Amazon Echo responding to voice commands issued by a user, LiFX lightbulb changing colour and intensity upon user request, Netatmo Welcome camera detecting an occupant and in- structing the LiFX light bulb to turn on with a specific colour, and so on. Our dataset well captures these two types of IoT traffic from a lab that represents a living smart environment (i.e. covering periods over which humans are present or absent in the environment).
To provide insights into the IoT traffic characteristics, we show in Fig. 2 a Sankey plot of network traffic seen over a 24 hour period for Amazon Echo and LiFX lightbulb. These devices are chosen just for illustrative purposes. Each plot depicts the flow-level information generated by the respective device. Flows are: (a) either unicast or multi- cast/broadcast, (b) destined to either local hosts (LAN) or Internet servers (WAN), and (c) tied to protocols (TCP, UDP, ICMP or IGMP) and port numbers.
traffic signature exhibited by the two devices. For example, DNS (port number 53) and NTP (port number 123) are used by both Amazon Echo and LiFX lightbulb. While Amazon Echo uses HTTP (port number80), HTTPS (port number 443) and ICMP (port number 0), LiFX lightbulb does not use any of these applications. Further, each device seems to communicate to a unique port numberon a WAN server; TCP 33434 for Amazon Echo andUDP 56700 for LiFX lightbulb, as shownby the top flow in Figures 2(a) and 2(b). Finally, we observe that Amazon Echo accesses a number of domain names including softwareupdates.amazon.com, device-metrics-su.amazon.com, example.org, pindorama.amazon.com and pool.ntp.org. However, LiFX lightbulb communicates with only two domains, i.e. v2.broker.lifx.co and pool.ntp.org.
To get in-depth knowledge on IoT, you can enroll for live IoT online course by OnlineITGuru with 24/7 support and lifetime access
No comments:
Post a Comment