Called function identification of IoT devices by network traffic analysis

ABSTRACTIoT devices are currently used in various situations, with the number of applications steadily increasing over the past few years. These IoT devices are connected to outside networks, and as such are often targets of hacking attempts and associated with private user information leaks. The end user is often unaware of how these devices operate, and as a result is unable to notice any unauthorized communication. In response, we aim to create a system to visualize the activity of an IoT device (IoT activity monitor). To create this system, we analyze the network traffic of an IoT device and propose a way to estimate which function it uses. Using Wire-Shark, a packet capture software, we evaluate the data transmitted from the Amazon Echo Spot, Amazon Echo Dot and Amazon Echo Flex, which are smart speakers. We confirmed that we can estimate 8~10 kinds of called functions with 76.1%, 89.8% and 85.2% accuracy for each smart speaker respectively.