Passive Identification of IoT Devices from IEEE 802.11 Frames Using Machine Learning

Abstract

This thesis investigates the identification of internet of things devices in wireless local area networks based on individual IEEE 802.11 frames using passive monitoring. The primary methodology utilizes machine learning, specifically a dual-branch fusion architecture combining a one-dimensional convolutional neural network and a multilayer perceptron. The classification model evaluates network traffic using an input consisting of raw data formed by the first 49 bytes of individual IEEE 802.11 frames and metadata describing traffic dynamics, such as frame inter-arrival times and total lengths. The model's actual generalization capability to completely new devices was tested through device-aware cross-validation and probability calibration. This method utilized network traffic data combined from multiple open-access network traffic sources.

The results indicate that the developed fusion model is capable of identifying the majority of IoT device network traffic while maintaining a low number of false alarms on a test set. Comparison with ablation models confirmed that reliable identification benefits from combining both structural protocol information and traffic dynamics. Although the method provides a computationally efficient tool for real-time network access management, the standardized structure of the IEEE 802.11 protocol establishes a natural upper limit on the identification accuracy of individual frames. In the future, the system's reliability in real world environments could be improved by integrating semi-supervised or active learning and by utilizing increasingly diverse training data.