scieee Open visual document viewer

DIFT-VAR: A DYNAMIC MULTI-LAYER FRAMEWORK FOR DEVICE FINGERPRINTING OF IDENTICAL DEVICES

Journal of Theoretical and Applied Information Technology

Abstract

Device fingerprinting is a powerful technique for identifying devices in an IoT environment, offering multiple advantages such as enhanced security through device authentication, improved network management by monitoring device behaviors, and anomaly detection for identifying unauthorized or compromised devices. The majority of recent fingerprinting schemes consider a heterogeneous device environment and use different machine learning techniques to identify devices using network traffic, signal-level information, radio frequency characteristics, etc. However, fingerprinting devices of the same make and model is a significant challenge in modern IoT environments, where many devices often share identical hardware and software configurations. Existing techniques cannot reliably differentiate identical devices as they lack sufficient data. This paper proposes a novel approach for Device Identification and Fingerprinting with Time-Variant Adaptive Recognition (DIFT-VAR) based on multi-layer, time-varying feature extraction. We construct dynamic fingerprints that uniquely identify each device by monitoring and fusing features such as probe request behavior, clock skew, transport layer characteristics, and radio signal metrics over time. We utilize machine learning algorithms such as Random Forests to classify devices based on these dynamic fingerprints. We further propose the use of dynamic time warping (DTW) for feature alignment and classification. Experimental results demonstrate the efficacy of our approach in distinguishing identical devices with an accuracy of over 97% using standard machine learning metrics.

Full text

Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4210 DIFT-VAR: A DYNAMIC MULTI-LAYER FRAMEWORK FOR DEVICE FINGERPRINTING OF IDENTICAL DEVICES MANOJ KUMAR VEMULA1, KAILA SHAHU CHATRAPATI 2 1Resea ch Schola , Depa men o CSE, JNTUH, Hyde abad, India 2P o esso , Depa men o CSE, JNTUH, Hyde abad, India E-mail: 1manojkuma [email protected], 2shahujn[email p o ec ed]om ABSTRACT De ice inge p in ing is a powe ul echnique o iden i ying de ices in an IoT en i onmen , o e ing mul iple ad an ages such as enhanced secu i y h ough de ice au hen ica ion, imp o ed ne wo k managemen by moni o ing de ice beha io s, and anomaly de ec ion o iden i ying unau ho ized o comp omised de ices. The majo i y o ecen inge p in ing schemes conside a he e ogeneous de ice en i onmen and use di e en machine lea ning echniques o iden i y de ices using ne wo k a ic, signal- le el in o ma ion, adio equency cha ac e is ics, e c. Howe e , inge p in ing de ices o he same make and model is a signi ican challenge in mode n IoT en i onmen s, whe e many de ices o en sha e iden ical ha dwa e and so wa e con igu a ions. Exis ing echniques canno eliably di e en ia e iden ical de ices as hey lack su icien da a. This pape p oposes a no el app oach o De ice Iden i ica ion and Finge p in ing wi h Time-Va ian Adap i e Recogni ion (DIFT-VAR) based on mul i-laye , ime- a ying ea u e ex ac ion. We cons uc dynamic inge p in s ha uniquely iden i y each de ice by moni o ing and using ea u es such as p obe eques beha io , clock skew, anspo laye cha ac e is ics, and adio signal me ics o e ime. We u ilize machine lea ning algo i hms such as Random Fo es s o classi y de ices based on hese dynamic inge p in s. We u he p opose he use o dynamic ime wa ping (DTW) o ea u e alignmen and classi ica ion. Expe imen al esul s demons a e he e icacy o ou app oach in dis inguishing iden ical de ices wi h an accu acy o o e 97% using s anda d machine lea ning me ics. Keywo ds: De ice inge p in ing, IoT Secu i y, Dynamic ime wa ping (DTW), Time- a ian ea u e ex ac ion, Machine lea ning o IoT secu i y. 1. INTRODUCTION An IoT (In e ne o Things) de ice is a physical objec embedded wi h senso s connec ed o he in e ne . This physical de ice di e s om any ypical compu e whose p ima y unc ionali y is no compu ing. IoT de ices connec ed o he in e ne ha e many ad an ages, including con enience, com o , sa e y, secu i y, eliabili y, e c. The IoT ma ke is a apidly expanding indus y ha co e s a wide ange o applica ions ac oss di e en business e icals, om e ail o heal h, anspo , manu ac u ing, en e ainmen e c. Ensu ing he secu i y o IoT de ices is essen ial o hei widesp ead adop ion. Due o de ice cons ain s, adi ional secu i y solu ions o con en ional compu ing pa adigms canno be di ec ly applied o IoT. Addi ional challenges include scalabili y, ope a ing en i onmen s, di e se de ice a chi ec u es, pla o ms, and p o ocols wi hin he IoT ecosys em. No ably, S a is a p ojec s ha by he end o 2024, o e 50 billion IoT de ices will be connec ed o he in e ne . P o ocols, a chi ec u es, and pla o ms employed by hese de ices a y g ea ly, and wi h a sho p oduc de elopmen li e- cycle, he numbe o endo s manu ac u ing hese p oduc s is nume ous. These challenges and IoT's open ope a ing en i onmen pose se e al secu i y challenges. Au hen ica ing a de ice be o e p o iding i wi h ne wo k access is he i s line o de ense o p o ec agains secu i y a acks in he cybe wo ld. E en hough many c yp og aphic schemes ailo ed o he IoT en i onmen ha e been de eloped, hese schemes (excep hose ha use PKI ce i ica es) a e ulne able o node o ge y o impe sona ion a acks, whe e he iden i y o he o he legi ima e de ices is employed [1], wi h sec e -keys (as secu i y c eden ials) being he mos popula way o au hen ica ing a de ice, weak passwo ds ollowed by unpa ched de ices wi h epo ed secu i y ulne abili ies subjec IoT de ices o comp omise. Once comp omised, hese de ices Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4211 can be exploi ed o leak con iden ial in o ma ion, used as launch pads o launch la ge-scale a acks ( o example, he ecen Mi ai Bo ne ), a ge c i ical in as uc u e, e c. The isk o a acks is signi ican ly heigh ened as de ices a e suscep ible o hacking, comp omising, and e e se enginee ing, as well as inadequa e secu i y managemen mechanisms in wi eless ne wo k sys ems. Thus, mul iple app oaches a e equi ed o secu e IoT de ices, anging om design conside a ions o moni o ing o po en ial a acks and implemen ing e ec i e mi iga ion s a egies. In a ne wo k, de ices a e usually iden i ied using IP add esses, MAC add esses, de ice se ial numbe s, e c. The limi a ion o hese iden i ie s is ha hey a e suscep ible o spoo ing. The abili y o spoo add esses o mul iple legi ima e de ices allows he a acke o launch mo e sophis ica ed a acks wi hou being de ec ed. Recen ly, de ice inge p in ing has eme ged as an al e na i e app oach o iden i y de ices, in which unique cha ac e is ics o a de ice a e used o gene a e de ice signa u es and used o iden i y de ices [6]. The p emise is o ex ac de ice ea u es o o de i e pa e ns h ough communica ions wi h he de ices. Di e en ne wo k laye s can con ibu e o his ea u e se , which can help in de eloping a inge p in o he de ice. De ice inge p in ing can be used no only o iden i y de ices, bu also o au hen ica e hem, p o ided he inge p in is unique [2]. Fu he mo e, a ew wo ks [3], [4], [5] ha e also employed inge p in ing o de ec hidden ea esd oppe s like a hidden came a, a ne wo k ea esd oppe , o any such passi e wi eless de ices o p o ec p i acy. Also, iden i ying a de ice ype helps in moni o ing he beha io o a pa icula de ice, he eby di e en ia ing he anomalous beha io om no mal beha io . I also helps in isola ing malicious nodes by main aining an asse lis . Unique inge p in s employed o au hen ica ion p e en he de ice iden i ies om being o ged. The majo s eps in ol ed in he inge p in ing p ocess a e: (1) iden i ying he ele an ea u es, (2) ex ac ing and modelling hem, and (3) iden i ying he de ice. Employing sui able machine lea ning algo i hms o achie e he abo e has made de ice inge p in ing an e ec i e echnique o add ess he unique secu i y challenges posed by IoT ne wo ks. The exis ing inge p in ing echniques can be ca ego ized based on he ea u es employed o iden i ying de ices: o example, ne wo k-based inge p in ing echniques ely on ne wo k a ic pa e ns [4], Wi-Fi based echniques use medium access con ol (MAC) sub-laye in o ma ion [5], clock-skew based me hods use sligh a ia ions in clock o each de ice[8], me hods based on elec omagne ic emana ions (EME) use unique signals om de ice componen s [7], and adio equency (RF) based echniques use physical laye in o ma ion like signal- o-noise a io and o he simila ac o s [8]. All hese echniques ely on some ype o machine lea ning algo i hm o classi y and iden i y de ices. Howe e , he majo challenge is o di e en ia e de ices ha a e iden ical in e ms o ha dwa e and so wa e con igu a ions. As he majo i y o he IoT p oduc s a e mass-manu ac u ed, hey end o be o iden ical con igu a ion, which makes he issue o de ice iden i ica ion mo e challenging [9]. 1.1. Mo i a ion And P oblem S a emen Typically, IoT de ices deployed o a speci ic applica ion, such as in sma homes, indus ial moni o ing, o heal hca e en i onmen s, a e comp ised o de ices ha may be iden ical in e ms o ha dwa e and so wa e con igu a ions. The limi a ions o s a ic ne wo k iden i ie s c ea e a signi ican challenge in iden i ying and di e en ia ing hese de ices once hey a e ope a ional wi hin he same ne wo k. He e, he ask is o uniquely inge p in IoT de ices o he same make and model wi hou elying on EME, which o en equi es specialized ha dwa e and is imp ac ical in la ge-scale deploymen s. E en hough he de ices a e iden ical in bo h ha dwa e and so wa e, hey s ill exhibi sub le di e ences in ne wo k beha io , communica ion iming, and usage pa e ns due o na u al a ia ions in manu ac u ing, en i onmen al ac o s, and in e nal p ocessing s a es. The majo i y o he exis ing wo ks ocused on he he e ogeneous ype o de ices and ha e p oduced signi ican de ice p o iling and au hen ica ion app oaches. Mo eo e , we highligh he wo k by collec ing minu e di e ences in signi ican pa ame e s wi h he ne wo k is in ope a ion om he a ious homogeneous de ices o add ess he au hen ica ion issues. In addi ion o his, he p oposed model has p oduced angible esul s in e ms o inge p in ing iden ical de ices. As he model ocused on ime se ies da a, which is collec ed wi h a ia ion in ime slo s. This wo k aims o design a no el inge p in ing me hod o cap u e and analyze hese sub le, na u ally occu ing a ia ions in de ice beha io o uniquely iden i y each de ice. This inge p in ing me hod should in eg a e mul i-laye ea u es o iden i y and inge p in de ices. Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4212 1.2 Con ibu ions This pape makes he ollowing con ibu ions:  We in oduce a no el mul i-laye app oach o inge p in ing iden ical de ices, le e aging ime- a ying ea u es ac oss he MAC, anspo , and physical laye s.  A dynamic ime wa ping (DTW)-based algo i hm is p oposed o empo al alignmen and classi ica ion o de ice inge p in s.  We demons a e h ough ex ensi e expe imen s ha ou app oach can success ully di e en ia e de ices o he same make and model, using eal-wo ld IoT da a. 2. RELATED WORKS De ice iden i ica ion and inge p in ing a e key o imp o e he secu i y pos u e in an IoT en i onmen whe e de ices a e suscep ible o comp omise. In his pape , we p esen di e en wo ks in his di ec ion o iden i ying IoT de ices, ocusing on hei e ec i eness, echnical de ails, s eng hs, and limi a ions. One o he simple app oaches o iden i ying de ices is based on de ice signa u es. These me hods c ea e ules based on known de ice beha io s, which can be e ec i e o iden i ica ion [10], [11]. Howe e , hese echniques equi e cons an upda es o adap o new de ices and h ea s. Al e na i ely, he ne wo k a ic gene a ed by IoT de ices can be used o lea n unique pa e ns ha can be used o classi y and iden i y de ices. Mul iple such wo ks use ne wo k a ic o de ice iden i ica ion [12], [13], [14], [15], [16]. Fo example, he au ho s o [12] use machine lea ning-based me hods o iden i y IoT de ices h ough ne wo k a ic analysis om a es se o nine de ices. The model achie es 99.28% accu acy in dis inguishing de ices u ilizing ne wo k ea u es. I pe o ms session-le el analysis and uses a mul is age classi ie o speci ic IoT iden i ica ion. Simila ly, he wo k p esen ed in [13] also uses di e en ne wo k a ic pa e ns such as ypes o a ic (e.g. di e en p o ocols), packe sizes, he equency o packe s along wi h hei s a is ical measu es, packe in e -a i ing imes, e c. o iden i y de ices using machine lea ning algo i hms and hen apply p ede ined secu i y measu es ollowing a secu i y policy. In [14], he au ho s add ess he challenge o managing a la ge numbe o IoT de ices in a la ge-scale IoT en i onmen such as a sma ci y. The p esen ed wo k uses ne wo k a ic analy ics o cha ac e ize and moni o IoT de ice beha io by collec ing a ic aces om a di e se se o IoT de ices ha include sma came as, sma ligh s, and heal h moni o s. Fea u es such as da a a es, ac i i y cycles, and signaling pa e ns we e employed o i s dis inguish IoT om non-IoT a ic and hen iden i y speci ic IoT de ices wi h mo e han 95% p ecision. O he wo ks based on ne wo k cha ac e is ics, like [15], use gene ic algo i hms o ea u e selec ion and di e en machine lea ning algo i hms o de ice classi ica ion. On he o he hand, he au ho s in [16] add ess he p oblem o da a imbalance in de ice classi ica ion. All o he abo e-men ioned app oaches use di e en ne wo k cha ac e is ics and ailo hei ML app oaches o de ice classi ica ion and iden i ica ion. O he app oaches o de ice iden i ica ion a e ei he RF-based, clock-skew based, o specialized ha dwa e-based echniques ha ha e hei espec i e ad an ages and limi a ions. RF- based de ice iden i ica ion schemes le e age he unique cha ac e is ics o he adio signals, such as signal's ampli ude, equency, and phase cha ac e is ics emi ed by IoT de ices, hen apply ML algo i hms o c ea e a dis inc inge p in o each de ice. The au ho s o [17], [18] p esen a su ey o such app oaches. In [19], he au ho s p opose o exploi he unique cha ac e is ics ound in he ene gy spec um o ansmi e u n-on ansien signals. These ansien signals con ain unique, ha dwa e-speci ic a ia ions ha se e as inge p in s o de ice iden i ica ion. The me hod ex ac s he ene gy dis ibu ion ac oss di e en equency componen s om hese ansien s, which helps o dis inguish be ween de ices, e en a low signal- o-noise a ios. In [20], he au ho s p esen an app oach ha con e s he ime se ies da a in o images ins ead o di ec ly using aw signals o ex ac ing s a is ical ea u es om hem. This ans o ma ion allows he use o well-es ablished image-p ocessing echniques and machine lea ning models ha a e pa icula ly powe ul o pa e n ecogni ion. App oaches based on clock skew ake ad an age o minu e di e ences in he in e nal clock a es o de ices o c ea e unique iden i ie s [21], [8]. This is done by moni o ing he ne wo k packe s sen by de ices o e ime o calcula e he de ia ion o each de ice's clock om a e e ence clock. Then, a unique p o ile is c ea ed based on he consis en skew pa e ns obse ed. A su ey o such app oaches is p esen ed in [18]. Mo e ecen ly, a clock skew-based de ice iden i ica ion scheme combined wi h a emo e a es a ion p o ocol has been p esen ed in [22] o class-I IoT de ices (de ices wi h andom access memo y less han 10 KB and code size less han 100 KB). The majo challenges wi h he clock skew-based Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4213 app oaches a e ha hey need con inuous moni o ing o e an ex ended pe iod o ime and a e a ec ed by ne wo k la ency and ji e . Apa om he a o emen ioned de ice iden i ica ion app oaches, ew o he wo ks conside a hyb id app oach [23], ha is o combine mul iple de ice cha ac e is ics and o he uses de ice senso s o inge p in ing [24]. Howe e , none o he abo e app oaches conside mul iple iden ical de ices wi h he same ha dwa e and i mwa e in hei es se up and e alua e he de ice iden i ica ion and inge p in ing app oaches. In his wo k, we p opose a no el app oach o De ice Iden i ica ion and Finge p in ing wi h Time-Va ian Adap i e Recogni ion (DIFT-VAR) ha is based on mul i- laye , ime- a ying ea u e ex ac ion. we cons uc dynamic inge p in s ha uniquely iden i y each de ice by moni o ing and using ea u es such as p obe eques beha io , clock skew, anspo laye cha ac e is ics, and adio signal me ics o e ime. Al e na i ely, o he wo ks ha e explo ed he issue o inge p in ing in a he e ogeneous en i onmen . Fo example, he wo k p esen ed in [25] p esen s a me hod o classi y IoT de ice ypes (e.g., came as, ou e s, p in e s) using Shodan me ada a. I emphasizes on he e ec i eness o using cu a ed me ada a and machine lea ning o accu a e iden i ica ion o IoT de ice ypes. The pape [26] explo es he use o ICMP and IP imes amp esponses o dis inguish be ween physical And oid de ices and i ual machines. Designed o de ec VM-based malwa e e asion, he s udy e eals consis en iming disc epancies ha se e as passi e indica o s o he execu ion en i onmen . The pape in [27] employs inge p in s o IOT de ices. I is ne wo k beha io -based, ex ac ing ea u es om he ne wo k, T anspo , and applica ion laye s, and has also employed neu al ne wo ks o classi ica ion. Employed neu al ne wo k o classi y IoT de ices by u ilizing 3 s ages, i.e, de ice ype, endo , and p oduc . He has employed a glo e and a Bi-LSTM o he applica ion laye da a. De ice beha io , howe e , a ies as when i mwa e upda es. The pape [28] u ilizes he MRFE deep lea ning app oach o ecognize IoT de ices using RF inge p in s. The model imp o es he iden i ica ion accu acy wi h mul i-dimensional ea u es. The da a se was acqui ed in noise noise- ee en i onmen . The model uses a inge p in -ampli ying laye , h ee- channel inpu , an A en ion mechanism, and esidual connec ions and ully connec ed laye s. The model depends mo e on he beha io o he RF da a. Howe e , he pe o mance o he model d ops o below 8dB o SNR 3. DIFT-VAR: THE PROPOSED FINGERPRINTING TECHNIQUE De ice iden i ica ion in a he e ogeneous IoT en i onmen is compa a i ely simple as he de ices exhibi su icien ly a ied cha ac e is ics ha can be cap u ed ia ne wo k, RF, de ice beha io , o clock skew, and o he simila app oaches. Howe e , in an IoT en i onmen whe e mul iple de ices sha e he same de ice a chi ec u e in e ms o bo h ha dwa e and i mwa e, he issue o de ice iden i ica ion becomes a challenge. The in e ac ion o hese de ices in a ne wo k exhibi s almos simila pa e ns ha a e ha d o dis inguish, especially when he de ices a e ope a ional on he same applica ion. A ypical use-case scena io is a su eillance sys em whe e a se o sma secu i y came as can belong o a single manu ac u e . The su eillance applica ion necessi a es ha all de ices epo su eillance da a ha can exhibi simila communica ion pa e ns. In such a scena io, he key is o exploi sub le a ia ions in hei beha io ha a ise om ha dwa e impe ec ions, ne wo k condi ions, and en i onmen al ac o s. In his wo k, we p opose a no el me hod o p ocessing he da a by le e aging mul i-laye da a usion combined wi h ime- a ying ea u e ex ac ion o c ea e unique de ice inge p in s o e ime. The co e idea is o design a mul i-laye , ime- a ying inge p in Cons uc ion me hod. Ra he han elying on a s a ic ea u e se , he p oposed app oach ocuses on he empo al e olu ion o ea u es ac oss mul iple laye s (MAC laye , adio cha ac e is ics, anspo laye , and iming da a) o di e en ia e de ices. The no el y is in dynamically combining empo al ends and sub le a ia ions in ne wo k and iming beha io o e ime, a he han s a ic snapsho s o ea u es. The p oposed app oach is named DIFT- VAR, whe e a ime- a ying mul i-laye inge p in ing app oach ha uses ea u es ac oss he MAC, anspo , and iming laye s. Ou app oach consis s o h ee main componen s: mul i- laye ea u e ex ac ion, ime- a ying ea u e agg ega ion, and classi ica ion using dynamic ime wa ping (DTW). The uniqueness lies in he p ocessing me hod, speci ically in di e en ia ing iden ical de ices based on a empo al dependency analysis using dynamic ime wa ping (DTW) and ecu en neu al ne wo ks (RNN) wi h an emphasis on sequence p ocessing. Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4214 3.1 Mul i-Laye Fea u e Fusion and Tempo al Va ia ion T acking. As iden ical de ices may exhibi sligh ha dwa e-induced a ia ions o e ime due o en i onmen al ac o s (like dis ance om he Wi-Fi access poin ), small a ia ions in he in e nal clock, o p ocessing speed di e ences ha a ise om manu ac u ing impe ec ions, we do no ely on a ixed da ase o ea u es collec ed a one poin in ime. We conside he e olu ion o ea u es o e ime and use da a ac oss mul iple laye s (MAC, adio, anspo , and iming) o c ea e a highly unique inge p in . A he MAC laye , we conside he MAC add ess and he ecei ed signal s eng h indica o (RSSI) o p obe eques s. The MAC add ess is conside ed a basic iden i ie . E en hough i can easily be spoo ed, i is conside ed a s a ing poin . We conside he Wi-Fi communica ion among de ices whe e de ices pe iodically send p obe eques s o ne wo k disco e y and e-associa ion. Le ( ) k i T ep esen he in e al be ween he i- h and (i+1)- h p obe eques s o he de ice k . To compa e de ices, we cons uc a ime-se ies ec o and use Dynamic Time Wa ping (DTW) o calcula e he simila i y be ween wo ime se ies. ( ) ( ) ( ( , ) : k m ST T ( ) ( ) ( ) ( ) 1 ( , ) min ( , ) n k m k m i j i DTW d T T   T T whe e ( , ) d   I is a dis ance me ic ( ypically Euclidean dis ance). The ime in e als be ween consecu i e p obe eques s can a y sligh ly due o in e nal ha dwa e di e ences and he iming p ecision o each de ice. The p obe eques s a e analyzed o suppo ed da a a es, SSID, and capabili ies. E en iden ical de ices can ha e sub le di e ences based on i mwa e o en i onmen al adap a ions. The iming o p obe eques s is used o gene a e a empo al pa e n o each de ice, which is hen compa ed using a dynamic ime-wa ping app oach o iden i y sub le di e ences in eques in e als. The RSSI alues a e cap u ed o packe s be ween he de ices and he Wi-Fi access poin . These alues a e collec ed con inuously since physical placemen and an enna di e ences cause a ia ions. Fo signal- o-noise a io (SNR), he signal quali y ela i e o he backg ound noise is measu ed. The di e ences in he de ice's RF componen s can esul in sligh bu de ec able a ia ions in SNR. Also, as each de ice may ha e sligh a ia ions in ansmission powe , i can lead o di e ences in RSSI o e ime. We se up mul iple access poin s o measu e how equen ly he de ices swi ch channels when nume ous access poin s a e a ailable, conside ing hei channel u iliza ion capabili ies. Le ( ) ( ) ( ) ( ) 1 2 [ , , , ] k k k k n  RSSI be he RSSI eadings o he de ice k . Fo di e en ia ion, calcula e he a iance o e a sliding window o size w : ( ) ( ) 2 ( ) 1 1 1 1 ( ) , whe e w w k k k RSSI i RSSI RSSI i i i w w           To cap u e changes o e ime, gene a e an agg ega ed ea u e ec o o each ime window: ( ) (1) (2) ( ) [ , , , ] k m RSSI RSSI RSSI RSSI     F The RSSI and SNR a e collec ed as ime- se ies da a. This in o ma ion is p ocessed using sequence models o iden i y he d i in signal s eng h o noise condi ions, p o iding unique iden i ie s o each de ice ega ding hei physical connec i i y o he ne wo k. We conside he TCP window size a he anspo laye le el and moni o he changes du ing da a exchanges. TCP sequence numbe s a e obse ed du ing he handshake and communica ion phases. The di e ence be ween sequence numbe s, o he sequence numbe gaps, can a y depending on how he de ice's ne wo k s ack handles e ansmissions and acknowledgmen s. Le he TCP sequence numbe s be ep esen ed as ( ) ( ) ( ) ( ) 1 2 ,[ , , ] k k k k n seq seq seq SEQ Using DTW o alignmen o sequence numbe s o iden i y sub le de ice-speci ic a ia ions, i is ep esen ed as ollows: ( ) ( ) ( ) ( ) pa hs 1 ( , ) min n k m k m i j i DTW seq seq     SEQ SEQ ‖ ‖ We conside he ound- ip ime (RTT) o TCP connec ions and consis en ly measu e he RTT be ween he de ices and a se e on he ne wo k. I s alue a ies based on clock skew and p ocessing speed di e ences. The TCP sequence numbe and window size a e modeled as ea u es con ibu ing o ne wo k beha io di e ences. The RTT is ea ed as empo al da a and is con inuously moni o ed o build a clock skew p o ile o e ime. The RTT is ep esen ed as ( ) k i RTT o de ice k . Using he ime-a e aged mean and a iance: Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4215 ( ) ( ) ( ) ( ) ( ) 2 1 1 1 1 , ( ) n n k k k k k RTT i RTT i RTT i i RTT RTT n n           Clock skew C( ) is he de ia ion o he clock o e ime. The clock skew is measu ed by sending ICMP pings o each de ice and eco ding he ound- ip ime (RTT). The d i o e ime is calcula ed o p oduce a clock skew alue ha is unique o each de ice. On he o he hand, he in e - a i al ime (IAT) o packe s, pa icula ly du ing high ac i i y, is measu ed. The clock skew unc ion o he de ice k can be ep esen ed as: ( ) k k k C     whe e k  is he d i a e and k  ep esen s he ini ial o se . Compa ing clock skews o wo de ices in ol es compu ing he di e ence: , ( ) | ( ) ( ) | k m k m C C C    Di e ences in clock d i and packe p ocessing speed esul in de ec able a ia ions in packe iming. The clock skew and IAT a e analyzed as ime-se ies ea u es, p o iding a unique empo al signa u e o each de ice. 3.2 Time-Va ying Fea u e Agg ega ion The p oposed app oach, algo i hm 1, conside s ea u es collec ed o e ime a he han s a ic ea u es collec ed a a single ime ins ance. This enables us o cap u e empo al pa e ns in ne wo k beha io ha a e sub le bu consis en ac oss iden ical de ices. We show ha ime- a ying pa e ns o en e eal mino di e ences due o en i onmen al o ha dwa e ac o s. To achie e ha , we con e key ea u es in o ime se ies da a and apply ime se ies analysis echniques like mo ing a e ages, Fou ie ans o ms, and wa ele analysis o cap u e empo al ends in ea u e beha io . The me hod chosen is dependen on he ea u e ype. Fo example, o analyze he RSSI alues ha luc ua e due o en i onmen al condi ions, we conside mo ing a e ages o smoo h ou he signal s eng h a ia ions. On he o he hand, o analyze p obe eques in e als and suspec ha a de ice sends eques s a egula in e als, we apply a Fou ie ans o m ha will highligh his cyclical pa e n. The Fou ie spec um will peak a he co esponding equency, hus allowing he di e en ia ion o de ices based on hei pe iodic beha io . Fo ea u es such as clock skew ha exhibi a long- e m d i sp ead ac oss wi h occasional a ia ions due o in e nal p ocessing delays, we employ wa ele analysis ha allows us o cap u e bo h he g adual changes and he sudden shi s in iming beha io . Algo i hm-1 Mul i-Laye De ice Finge p in ing wi h Tempo al Sequence Analysis 1. Inpu : 2. Se o N de ices 1 2 { , , , } N D D D 3. Fo each de ice i D , collec ime-se ies da a i X : 4. MAC laye ea u es i MAC 5. Radio cha ac e is ics , i i RSSI SNR 6. T anspo laye ea u es , , i i i TCPSeq RTT TCPWnd 7. Timing ea u es , i i P obe In e al Clock Skew 8. Fea u e Ex ac ion: 9. Fo each de ice i D , ex ac ime-se ies ea u es: 10. MAC laye ea u es: , i i MAC P obe In e al 11. Radio cha ac e is ics: , i i RSSI SNR 12. T anspo laye ea u es: , , i i i TCPSeq RTT TCPWnd 13. Timing ea u es: i Clock Skew 14. Time-Se ies Alignmen Using DTW: 15. Fo each de ice i D and ea u e i X , pe o m DTW on sequences o : 16. , i i P obe In e al TT R 17. Compu e he DTW dis ance o align iming a ia ions: 18. ( ) DTW i S X 19. Tempo al Modeling Using LSTM: 20. T ain an LSTM on ime-se ies da a Xi o each ea u e: 21. , , , i i i i RSSI RTT TCPSeq Clock Skew 22. Ou pu a sequence embedding ( ) LSTM i E X o each de ice 23. Fea u e Fusion: 24. Fuse all ea u es in o a ea u e ec o Fi : , , , ( ), ( ), , , i i i i DTW i LSTM i i i i MAC RSSI SNR F S X E X TCPSeq RTT TCPWnd            Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4216 25. Classi ica ion: 26. T ain a Random Fo es classi ie using he ea u e ec o s i F 27. Au hen ica ion: 28. Gi en an unknown de ice j D , ex ac he ea u e ec o j F 29. Classi y j F using he ained classi ie o au hen ica e j D . 30. Ou pu : De ice classi ica ion and unique inge p in o au hen ica ion. Fu he , we employ a sliding window app oach whe e he key ea u es a e calcula ed dynamically wi hin ime windows a he han s a ic ea u e ec o s, hus c ea ing a empo al inge p in wi h dynamic windows. Fo a ime- a ying ea u e ( ) ( ) k X , we ex ac ea u es using a sliding window app oach o size w . ( ) ( ) 1 ( ) ( ) w k k window i X X i w    Fo each ime window, we cap u e and summa ize a ia ions in key ea u es like clock skew, RSSI, TCP beha io , and p obe eques iming. Fo each o he de ice, he agg ega e ea u es om mul iple laye s wi hin a dynamic ime window c ea es a composi e inge p in . We employ a weigh ed app oach o gi e mo e impo ance o laye s ha exhibi g ea e a iabili y be ween de ices. Fea u es calcula ed o each sliding window a e used o gene a e dynamic inge p in s ha emphasize a iabili y o e ime. The key componen s o he p oposed a chi ec u e a e shown in Figu e 1. 3.3 Mul i-Resolu ion Fea u e Ma ching To uniquely di e en ia e de ices, he p oposed app oach pe o ms a mul i- esolu ion analysis, whe e ea u es a e compa ed a di e en le els o g anula i y. To begin wi h, o each o he de ices, we c ea e bo h sho - e m and long- e m ea u e p o iles. The sho - e m p o iles cap u e immedia e luc ua ions, while long- e m p o iles ack cumula i e beha io o e an ex ended pe iod o ime. Then, we aim o di e en ia e de ices based on a combina ion o sho - e m and long- e m p o iles using echniques like dynamic ime wa ping (DTW) o align and compa e ime se ies da a, accoun ing o sligh ime shi s o phase di e ences. We de ine he sho - e m ( ) k S and long- e m ( ) k L ea u e ec o s o each de ice k as ollows: ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) 1 2 1 2 [ , , , ], [ , , , ] k k k k k k k k n m s s s l l l    S L DTW is used o measu e he simila i y be ween empo al sequences o di e en de ices. DTW allows o alignmen o ime-se ies da a ha migh be ou o phase bu s ill ep esen simila pa e ns. We apply DTW o align and compa e he de ice p o iles using: ( ) ( ) ( ) ( ) ( , ) ( , ) k m k m DTW DTWS S L L 3.4 Fea u e Fusion and Classi ica ion Fo di e en ia ing and iden i ying de ices we employ a ea u e usion app oach. In his me hod, we combine ea u es om all laye s (MAC, adio, anspo , and iming) o c ea e a comp ehensi e ea u e ec o o each de ice. Fo any ea u e ec o , le ( ) k F ep esen he ea u e ec o o de ice k , con aining ea u es om MAC, adio, anspo , and iming laye s: ( ) ( ) ( ) ( ) ( ) ( ) [ , , , , ] k k k k k k MAC adio anspo iming LSTM F F F F hF The weigh ed usion o ea u es, whe e weigh i w co esponds o he a iabili y o each ea u e is ep esen ed as: ( ) ( ) , 1 k k composi e i i i i i F w F wi h w     Nex , we employ he Random Fo es classi ie s o ain on he used ea u e se . The LSTM ou pu ( empo al analysis) is also included in he ea u e se , p o iding addi ional empo al con ex o he classi ie . The used ea u es a e used o c ea e a unique inge p in o each de ice. The aining o he Random Fo es classi ie on he used ea u e ec o s ( ) k F is ep esen ed as ollows, whe e ˆ y is he p edic ed class: ( ) ˆ ( ) k y Classi ie F The combined use o ime-se ies alignmen (DTW), empo al sequence modeling (LSTM), and laye -speci ic ea u es makes he p oposed app oach unique. Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4217 3.5 De ice Iden i ica ion The p oposed app oach iden i ies de ices by collec ing da a o e an ex ended pe iod and c ea ing a de ice p o ile. Con inuous da a collec ion in ol es con inuously ga he ing ea u es ac oss all ele an laye s o main ain bo h sho - e m and long- e m p o iles o each de ice. In he ma ching and classi ica ion p ocess, DTW is applied o align newly collec ed ime-se ies da a wi h s o ed p o iles. An LSTM model is used o in e empo al dependencies in eal- ime ea u es. The aligned da a and LSTM ou pu s a e hen used and classi ied using a ained Random Fo es classi ie o au hen ica e he de ice. In he decision- making s age, au hen ica ion is de e mined based on he DTW alignmen sco e and he Random Fo es classi ica ion. I is ep esen ed as ollows: De ice au hen ica ion is based on compa ing he DTW alignmen sco e DTW Sco e and classi ica ion ou come: ˆ DTW ue Au hen ica e i Sco e and y y    I he compu ed sco e is below he es ablished h eshold, he de ice is conside ed un ecognized o spoo ed. Fig. 1 The p oposed de ice iden i ica ion model 4. EXPERIMENTAL RESULTS To analyze he pe o mance o he p oposed de ice iden i ica ion and inge p in ing algo i hm, we se up a ne wo k o 10 ESP32- WROOM-32 mic ocon olle s, all unning he same i mwa e and communica ing o e a Wi-Fi ne wo k. Each de ice has he same se o senso s ( empe a u e, humidi y, ligh ), which epo da a e e y 60 seconds. This expe imen aims o e alua e he abili y o uniquely inge p in iden ical de ices using mul i-laye ea u e ex ac ion and ime-se ies p ocessing echniques. The expe imen will cap u e Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4218 he MAC laye , adio cha ac e is ics, anspo laye , and iming ea u es, hen p ocess he da a using Dynamic Time Wa ping (DTW) and LSTM- based empo al modeling. 4.1 Ha dwa e Se -up Table 1 p o ides a de ailed ESP32- WROOM-32 mic ocon olle speci ica ion summa y. The boo p ocess in ol es he i s -s age boo loade , pa o he ROM. The second-s age boo loade is s o ed in Flash and can be cus omized. The pa i ion able de ines he lash memo y layou , and he applica ion is pa o he main i mwa e code. The ESP32 so wa e de elopmen ki SDK, also known as he ESP-IDF (Esp essi IoT De elopmen F amewo k), p o ides a comp ehensi e se o ools, lib a ies, and applica ion p og amming in e aces (APIs) ha allow us o access and manipula e a ious ha dwa e ea u es o he ESP32. The SDK p o ides APIs o di ec access o ha dwa e ea u es like ADC (Analog- o-Digi al Con e e ), ime s, and RF componen s. This low-le el access allows o p ecise measu emen s o ha dwa e cha ac e is ics. The ESP-IDF includes a ull- ea u ed Wi-Fi and Blue oo h s ack, enabling ine-g ained con ol o e wi eless communica ions. This can be used o implemen cus om ansmission pa e ns o analyze ecep ion cha ac e is ics. The SDK is buil on F eeRTOS, enabling p ecise iming con ol and ask managemen . I can be le e aged o c ea e unique beha io al pa e ns o measu e sys em esponse imes accu a ely. Las ly, ESP-IDF p o ides ad anced powe managemen capabili ies, allowing o measu ing and con olling powe consump ion pa e ns, which can a y be ween de ices. The main CPU clock speed is up o 240 MHz wi h an in e nal 150 kHz RC oscilla o and an ex e nal c ys al o 40 MHz.. The in e nal oscilla o is 8 MHz wi h calib a ion. The in e nal RC oscilla o and PLL ci cui s can a y sligh ly due o manu ac u ing p ocesses, a ec ing hei exac equencies. Also, empe a u e and ol age luc ua ions can cause sub le clock d i pa e ns unique o each de ice. The ESP32's abili y o dynamically adjus clock speeds can be used o c ea e unique beha io al pa e ns. The de ice suppo s IEEE 802.11 b/g/n (2.4 GHz) p o ocols wi h an adjus able ansmi powe o up o +20 dBm o a ecei e sensi i i y o up o -98 dBm. All he de ices a e connec ed o he same Wi-Fi access poin (TP-Link A che C7). The de ices use HTTP as he communica ion p o ocol o ansmi senso da a. Table 1: Key Speci ica ions o Esp32-W oom-32. Fea u e Speci ica ion P ocesso Dual - co e X ensa LX6, 32 - bi Clock Speed Up o 240 MHz RAM 520 KB SRAM ROM 448 KB Flash Memo y 4 MB (expandable o 16 MB) Wi - Fi 802.11 b/g/n (2.4 GHz) Blue oo h 4.2 BR/EDR and BLE GPIO Pins 34 p og ammable ADC 12 - bi , up o 18 channels DAC 2x 8 - bi channels Ha dwa e C yp o AES, SHA, RSA, ECC RTC 150 kHz in e nal oscilla o Ex e nal C ys al 40 MHz Powe Consump ion A e age 80mA Ope a ing Vol age 3.0V o 3.6V Ope a ing Tempe a u e -40°C o +85°C 4.2 Da a Collec ion and Da a P ocessing In his expe imen , we collec da a om 10 iden ical ESP32-WROOM-32 mic o-con olle s. Each de ice sends senso da a pe iodically. The ollowing da a is collec ed as shown in he Table.2 The ea u es a e collec ed o e mul iple sessions o ensu e su icien da a is cap u ed o analysis. The a ia ions in he da a a e expec ed due o he mino ha dwa e and en i onmen al di e ences ac oss de ices, e en hough he de ices a e iden ical. The da a p ocessing pipeline is comp ised o wo main s ages, i.e., ime-se ies alignmen using DTW and empo al modeling using LSTM o cap u e he empo al dependencies o each o he de ice beha io . Time-se ies da a o ea u es like P obe Reques In e als, RTT, and IAT a e ex ac ed om each de ice. The aim o using DTW is o align sequences o ime-se ies da a o accoun o any a ia ion due o di e ences in clock skew, p ocessing delays, o en i onmen al ac o s. Fo each ea u e (e.g., P obe Reques In e al), we compu e he DTW dis ance be ween each de ice’s ime-se ies da a and a e e ence sequence. We hen align he ime-se ies da a based on he minimum DTW dis ance o ob ain a simila i y sco e ( ( ) DTW i S X o each de ice i X . The ou come is a se o aligned sequences ha cap u e he iming a ia ions ac oss de ices. To achie e empo al modeling using LSTM, we conside he ime-se ies da a om mul iple sessions o ea u es like RSSI, RTT, TCP sequence numbe s, and clock skew as inpu . The LSTM ne wo k con igu a ion has an inpu laye , whe e he inpu is he ime-se ies da a om each Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4225 s uden s, and o he s uden s (S3) Wo kshop, e . S3 ’21. New Yo k, NY, USA: Associa ion o Compu ing Machine y, 2021, p. 6–7. [Online]. A ailable: h ps://doi.o g/10.1145/3477087.3478381. [8] T. Kohno, A. B oido, and K. Cla y, “Remo e physical de ice inge -p in ing,” in 2005 IEEE Symposium on Secu i y and P i acy (SP’05),2005, pp. 211–225. [9] J. Ku mi and R. Ma am, “De ice iden i ica ion in io ne wo ks using ne wo k ace inge p in ing,” in 2022 In e na ional Con e ence on Sma Applica ions, Communica ions and Ne wo king (Sma Ne s), 2022, pp. 1–6. [10] V. Visoo i ise h, P. Saka in, J. Thongwilai, and T. Choobanjong, “Signa u e-based and beha io -based a ack de ec ion wi h machine lea ning o home io de ices,” in 2020 IEEE REGION 10 CONFERENCE (TENCON),2020, pp. 829–834. [11] N. Youse nezhad, A. Malhi, and K. F amling, “Secu i y in p oduc li ecycle o io de ices: A su ey,” Jou nal o Ne wo k and Compu e Applica ions, ol. 171, p. 102779, 2020. [Online]. A ailable: h ps://www.sciencedi ec .com/science/a icle/p ii/S1084804520302538. [12] Y. Meidan, M. Bohadana, A. Shab ai, J. D. Gua nizo, M. Ochoa,N. O. Tippenhaue , and Y.Elo ici, “P o ilio : a machine lea ning app oach o io de ice iden i ica ion based on ne wo k a ic analysis,” in P oceedings o he Symposium on Applied Compu ing,se . SAC’17. New Yo k, NY, USA: Associa ion o Compu ing Machine y, 2017, p. 506–509. [Online]. A ailable: h ps://doi.o g/10.1145/3019612.3019878. [13] M. Mie inen, S. Ma chal, I. Ha eez, N.Asokan, A.-R. Sadeghi,and S. Ta koma, “Io sen inel: Au oma ed de ice- ype iden i ica ion o secu i y en o cemen in io ,” in 2017 IEEE 37 h In e na ional Con e ence on Dis ibu ed Compu ing Sys ems (ICDCS), 2017, pp.2177– 2184. [14] A. Si ana han, D. She a , H. H. Gha akheili A.Rad o d, C. Wi-jenayake, A. Vishwana h, and V. Si a aman, “Cha ac e izing and classi ying io a ic in sma ci ies and campuses,” in 2017 IEEE Con e ence on Compu e Communica ions Wo kshops (INFOCOMWKSHPS), 2017, pp. 559–564. [15] A. Aksoy and M. H. Gunes, “Au oma ed io de ice iden i ica ion using ne wo k a ic,” in ICC 2019 - 2019 IEEE In e na ional Con e ence on Communica ions (ICC), 2019, pp. 1–7. [16] M. Mainuddin, Z. Duan, Y. Dong, S. Salman, and T. Taami, “Io de ice iden i ica ion based on ne wo k a ic cha ac e is ics,” in GLOBECOM 2022 - 2022 IEEE Global Communica ions Con e ence, 2022, pp.6067– 6072. [17] L. Xie, L. Peng, J. Zhang, and A. Hu, “Radio equency inge p in iden i ica ion o in e ne o hings: A su ey,” Secu i y and Sa e y, ol.3, p. 2023022, 2024. [18] A. Jaganna h, J. Jaganna h, and P. S. P. V. Kuma , “A comp ehensi e su ey on adio equency ( ) inge p in ing: T adi ional app oaches, deep lea ning, and open challenges,” Compu e Ne wo ks, ol. 219, p. 109455, 2022. [Online]. A ailable: h ps://www.sciencedi ec .com/science/a icle/p ii/S1389128622004893. [19] M. K¨ose, S. Tas¸cio˘glu, and Z. Tela a , “R inge p in ing o io de ices based on ansien ene gy spec um,” IEEE Access, ol. 7, pp. 18 715–18 726, 2019. [20] G. Baldini, G. S e i, R. Giuliani, and C. Gen ile, “Imaging ime se ies o in e ne o hings adio equency inge p in ing,” in 2017 In e na ional Ca nahan Con e ence on Secu i y Technology (ICCST), 2017, pp. 1–6 [21] T. Kohno, A. B oido, and K. C. Cla y, “Remo e physical de ice inge -p in ing,” IEEE T ansac ions on Dependable and Secu e Compu ing, Vol. 2, no. 2, pp. 93–108, 2005. [22] C. Shang, J. Cao, T. Zhu, Y. Zhang, B. Niu, and H. Li, “Cad a: A clock skew-based ac i e de ice inge p in au hen ica ion scheme o class-1 io de ices,” IEEE Sys ems Jou nal, 2024. [23] H. Wang, D. Eklund, A. Op ea, and S. Raza, “Fl4io : Io de ice inge p in ing and iden i ica ion using ede a ed lea ning,” ACM T ans. In e ne Things, ol. 4, no. 3, Jul. 2023. [Online]. A ailable: h ps://doi.o g/10.1145/3603257. [24] H. Bojino , Y. Michale sky, G. Nakibly, and D. Boneh, “Mobile de ice iden i ica ion ia senso inge p in ing,” a Xi p ep in a Xi :1408.1416, 2014. [25] F. Z. Fag oud, H. Toumi, E. H. B. Lahma , K. Ach aich, S. E. Filali, and Y. Baddi, “Connec ed de ices classi ica ion using ea u e selec ion Jou nal o Theo e ical and Applied In o ma ion Technology 31s May 2025. Vol.103. No.10 © Li le Lion Scien i ic ISSN: 1992-8645 www.ja i .o g E-ISSN: 1817-3195 4226 wi h machine lea ning,” IAENG In e na ional Jou nal o Compu e Science, ol. 49, no. 2, 2022. [26] M. Noo a iza, K. Ishak, H. Maeda, M. Shi a o i, T. Kinoshi a, and R. Uda, “Cha ac e is ic pa e ns o imes amps om and oid ope a ing sys em on mobile de ice and i ual machine.” IAENG In e na ional Jou nal o Compu e Science, ol. 43, no. 2, 2016. [27] K. Yang, Q. Li, and L. Sun, “Towa ds au oma ic inge p in ing o io de ices in he cybe space,” Compu e Ne wo ks, ol. 148, pp. 318–327,2019. [Online]. A ailable: h ps://www.sciencedi ec .com/science/a icle/p ii/S1389128618306856. [28] Qian Lu , Zaikai Yang , Hanlin Zhang “MRFE: A Deep-Lea ning-Based Mul idimensional Radio F equency Finge p in ing Enhancemen App oach o IoT De ice Iden i ica ion IEEE INTERNET OF THINGS JOURNAL, VOL. 11, NO. 18, 15 SEPTEMBER 2024 [Online] A ailable:h ps://ieeexplo e.ieee.o g/s amp/s am p.jsp? p=&a numbe =10556754