Adaptive camouflage reduces IoT device fingerprinting with low overhead
Adaptive Traffic Camouflage: Causal and Resource-Aware Defense Against IoT Fingerprinting
Cryptography and SecurityNetworking and Internet Architecture
Summary
Even when data is encrypted, spying on smart devices can still figure out what type they are by looking at patterns in their internet traffic. The authors created a method that changes the shape of this traffic in smart ways to hide device identity without slowing things down or using too much extra data. Their method learns from recent traffic to decide the best way to hide information, sometimes leaving traffic alone if hiding isn't needed. Tests show this method cuts down how well attackers can recognize devices, though some tough attackers might still do better if they adjust.
What this means in practice
- •For network security teams: Obfuscate IoT device identities in network traffic to protect user privacy against fingerprinting attacks under communication constraints.
- •For smart home system integrators: Improve privacy of connected devices by embedding adaptive traffic camouflage that minimizes added bandwidth and latency.
Authors
Daniel Adu Worae, Spyridon Mastorakis, Nuno Moniz, Nitesh V. Chawla
Abstract
Encryption hides IoT payloads, but traffic shape can still reveal device identity through packet sizes, timing, direction, and packetization. We present Adaptive Traffic Camouflage, a causal, leakage-aware controller that characterizes traffic-shape leakage without runtime device labels and selects a budget-feasible transformation for the next traffic window from previous-window context. The controller chooses among padding, packet splitting, timing, and composite transformations, or leaves traffic unchanged when camouflage is unnecessary. We evaluate the design on CIC-IoT-2022, IoT Sentinel, and UNSW using classical and sequence-based fingerprinting models under clean-trained, defense-aware, and incremental-exposure settings, with fixed, random, and mean-bandwidth-matched baselines. Under the Balanced profile, camouflage reduces mean Macro-F1 by 13.2-23.3% relative to clean traffic with 4.88-7.47% average bandwidth overhead and at most 0.64 ms added latency. Under the larger Privacy profile, the reduction increases to 28.0-43.5%. Defense-aware training recovers much of the lost attacker performance on CIC-IoT-2022 and UNSW, while IoT Sentinel retains a substantial privacy gap. A non-causal same-window reference provides only modest additional benefit over previous-window control, and metadata-rich attackers remain effective outside the targeted traffic-shape surface. These results show that causal, resource-aware camouflage can reduce IoT traffic-shape fingerprintability under explicit communication constraints, while the persistence of protection depends on how readily the defended distribution can be learned.