Abstract

With the rapid proliferation of Internet of Things (IoT) devices, security has become a significant challenge—particularly impersonation attacks, where an adversary masquerades as a trusted device. In this paper, we introduce a machine learning framework that fingerprints IoT devices and catches impersonation attacks by analyzing their network traffic. We train a Random Forest classifier on statistical features extracted solely from benign traffic of nine commercial IoT devices (N-BaIoT dataset). The model achieves highly accurate device identification with a weighted accuracy and F1-score of 98.63% and can clearly distinguish different device types. For impersonation detection, we use the fingerprinting model’s confidence: traffic that does not match any known device with high certainty is flagged as an impostor. The confidence-based anomaly detection scheme, evaluated on Mirai and Gafgyt attack traffic, achieves a 93.5% true positive rate at a 1.2% false positive rate. The approach is entirely passive, requiring no modifications to the devices themselves, is sufficiently lightweight for deployment on resource-constrained edge devices, and produces interpretable results.