# A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets

arXiv: https://arxiv.org/abs/2008.03343 · HTML: https://mlsanity.com/paper/2008.03343/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Aug 2020.

## Built on by (most cited first, 15 of 15)

- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Fedstellar: A Platform for Decentralized Federated Learning](https://mlsanity.com/paper/2306.09750/) (2023)
- [Studying the Robustness of Anti-adversarial Federated Learning Models Detecting Cyberattacks in IoT Spectrum Sensors](https://mlsanity.com/paper/2202.00137/) (2022)
- [RL and Fingerprinting to Select Moving Target Defense Mechanisms for Zero-day Attacks in IoT](https://mlsanity.com/paper/2212.14647/) (2022)
- [Robust Federated Learning for execution time-based device model identification under label-flipping attack](https://mlsanity.com/paper/2111.14434/) (2021)
- [A Lightweight Moving Target Defense Framework for Multi-purpose Malware Affecting IoT Devices](https://mlsanity.com/paper/2210.07719/) (2022)
- [usfAD Based Effective Unknown Attack Detection Focused IDS Framework](https://mlsanity.com/paper/2403.11180/) (2024)
- [Adversarial attacks and defenses on ML- and hardware-based IoT device fingerprinting and identification](https://mlsanity.com/paper/2212.14677/) (2022)
- [CyberForce: A Federated Reinforcement Learning Framework for Malware Mitigation](https://mlsanity.com/paper/2308.05978/) (2023)
- [WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces](https://mlsanity.com/paper/2403.07540/) (2024)
- [RansomAI: AI-powered Ransomware for Stealthy Encryption](https://mlsanity.com/paper/2306.15559/) (2023)
- [Analyzing Consumer IoT Traffic from Security and Privacy Perspectives: a Comprehensive Survey](https://mlsanity.com/paper/2403.16149/) (2024)
- [Privacy-Enhanced Training-as-a-Service for On-Device Intelligence: Concept, Architectural Scheme, and Open Problems](https://mlsanity.com/paper/2404.10255/) (2024)
- [A Factored MDP Approach To Moving Target Defense With Dynamic Threat Modeling and Cost Efficiency](https://mlsanity.com/paper/2408.08934/) (2024)
- [An AI-Based Solution for Secure Service Provisioning in IoT](https://mlsanity.com/paper/2606.30701/) (2026)

## Abstract (arXiv)

In the current network-based computing world, where the number of interconnected devices grows exponentially, their diversity, malfunctions, and cybersecurity threats are increasing at the same rate. To guarantee the correct functioning and performance of novel environments such as Smart Cities, Industry 4.0, or crowdsensing, it is crucial to identify the capabilities of their devices (e.g., sensors, actuators) and detect potential misbehavior that may arise due to cyberattacks, system faults, or misconfigurations. With this goal in mind, a promising research field emerged focusing on creating and managing fingerprints that model the behavior of both the device actions and its components. The article at hand studies the recent growth of the device behavior fingerprinting field in terms of application scenarios, behavioral sources, and processing and evaluation techniques. First, it performs a comprehensive review of the device types, behavioral data, and processing and evaluation techniques used by the most recent and representative research works dealing with two major scenarios: device identification and device misbehavior detection. After that, each work is deeply analyzed and compared, emphasizing its characteristics, advantages, and limitations. This article also provides researchers with a review of the most relevant characteristics of existing datasets as most of the novel processing techniques are based on machine learning and deep learning. Finally, it studies the evolution of these two scenarios in recent years, providing lessons learned, current trends, and future research challenges to guide new solutions in the area.