# PingPong: Packet-Level Signatures for Smart Home Device Events

arXiv: https://arxiv.org/abs/1907.11797 · HTML: https://mlsanity.com/paper/1907.11797/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 26 Jul 2019.

## Built on by (most cited first, 3 of 3)

- [Revisiting IoT Device Identification](https://mlsanity.com/paper/2107.07818/) (2021)
- [IoTFlowGenerator: Crafting Synthetic IoT Device Traffic Flows for Cyber Deception](https://mlsanity.com/paper/2305.00925/) (2023)
- [GeMID: Generalizable Models for IoT Device Identification](https://mlsanity.com/paper/2411.14441/) (2024)

## Abstract (arXiv)

Smart home devices are vulnerable to passive inference attacks based on network traffic, even in the presence of encryption. In this paper, we present PINGPONG, a tool that can automatically extract packet-level signatures for device events (e.g., light bulb turning ON/OFF) from network traffic. We evaluated PINGPONG on popular smart home devices ranging from smart plugs and thermostats to cameras, voice-activated devices, and smart TVs. We were able to: (1) automatically extract previously unknown signatures that consist of simple sequences of packet lengths and directions; (2) use those signatures to detect the devices or specific events with an average recall of more than 97%; (3) show that the signatures are unique among hundreds of millions of packets of real world network traffic; (4) show that our methodology is also applicable to publicly available datasets; and (5) demonstrate its robustness in different settings: events triggered by local and remote smartphones, as well as by homeautomation systems.