BitIoT: A Bit Level Deep Packet Inspection Method for Identification of MQTT-Based IoT Devices in the Wild

With the growing popularity of IoT devices, the contribution of IoT network traffic on the Internet is increasing. IoT network traffic is monitored for security analysis, maintaining the Quality of Services (QoS), etc., in a smart environment. IoT traffic is highly heterogeneous because of two main reasons. First, IoT devices use a variety of communication protocols like HTTP(s), MQTT, CoAP, etc., among which MQTT is widely used due to its lightweight design. Second, many IoT devices are frequently installed and removed from a network as needed. Thus, it is important to identify unknown IoT devices in the network traffic to maintain security and QoS. Also, identification should be lightweight enough to cater to highly dynamic environments. To fill this gap, we propose BitIoT, an unsupervised and lightweight bit-level deep packet inspection method for accurately identifying MQTT-based IoT devices in the network traffic. After Identification, BitIoT generates bit-level signatures for identified IoT devices, which are further used for signature-based classification. Furthermore, we propose a novel data structure called BinMap, which performs fast and accurate signature-based classification. We tested BitIoT on two different datasets containing network traces of 29 MQTT-based IoT devices and found that BitIoT identified all the devices successfully. Moreover, the classification from the generated signatures results in an average recall rate of 99.1%.