andypitcher / IoT_Sentinel

IoT SENTINEL : Automated Device-Type Identification for Security Enforcement in IoT
https://arxiv.org/pdf/1611.04880.pdf
MIT License
41 stars 32 forks source link

IoT_Sentinel

This program is an implementation of IoT sentinel: https://arxiv.org/pdf/1611.04880.pdf
Device Fingerprint, it takes as input pcaps and tests each packets against 23 features:

Link layer protocol (2)                 ARP/LLC
Network layer protocol (4)              IP/ICMP/ICMPv6/EAPoL
Transport layer protocol (2)            TCP/UDP
Application layer protocol (8)          HTTP/HTTPS/DHCP/BOOTP/SSDP/DNS/MDNS/ NTP
IP options (2)                          Padding/RouterAlert
Packet content (2)                      Size (int)/Raw data
IP address (1)                          Destination IP counter (int)
Port class (2)                          Source (int) / Destination (int)

Usage:

iot_fingerprint.py -d <inputdir> [or] -i <inputpcap> -l <label> [and] -o <outputdir>  
Example: ./iot-fingerprint.py -d captures_IoT_Sentinel/captures_IoT-Sentinel/ -o csv_result_full/