Pith. sign in

REVIEW 3 major objections 4 minor 42 references

Hiding in Plain Sight: An IoT Traffic Camouflage Framework for Enhanced Privacy

T0 review · 3 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A six-technique traffic obfuscation framework can hide smart-home IoT devices from traffic analysis, even when classifiers are retrained on the obfuscated traffic.

desk verdict A useful empirical snapshot of six known obfuscation techniques, but the central privacy claim is undone by an architectural gap the paper itself acknowledges. read the letter →

arxiv 2501.15395 v1 pith:EMDMTRR6 submitted 2025-01-26 cs.CR cs.NI

Daniel Adu Worae , Spyridon Mastorakis This is my paper · ORCID
classification cs.CRcs.NI
keywords IoTprivacytrafficanalysisobfuscationpacketpaddingdelayrandomizationmachinelearningclassifiersadaptiveadversariessmarthome
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a middlebox-based obfuscation framework that tries to make smart-home IoT traffic unreadable to passive network observers by randomizing packet size, payload structure, and timing instead of hiding content. It combines six reversible techniques—padding, padding with XORing, padding with shifting, constant-size padding, fragmentation, and delay randomization—and evaluates them on three public datasets with five machine-learning classifiers. Its central claim is that the combined approach sharply degrades accuracy, precision, recall, and F1 on all datasets, and that classifiers retrained or fine-tuned on obfuscated traffic still perform far below their baseline. The paper also reports a tunable trade-off: stronger obfuscation improves privacy but adds bytes, latency, and processing overhead. If the claim holds, a home gateway could make it much harder for Wi-Fi or WAN sniffers to identify devices or infer user routines.

What carries the argument

The central object is a middlebox pipeline that intercepts outgoing IoT packets and applies six reversible transformations: random padding, padding combined with XORing, padding combined with shifting, constant-size padding, fragmentation, and delay randomization. A recovery header of 2–4 bytes, placed at a dynamically determined location, tells the receiver which transformation was used and supplies the parameters needed to reverse it. The load-bearing mechanism is the combination and randomization of several traffic dimensions, so that no single pattern—packet size, payload structure, or timing—remains stable enough for a classifier to exploit.

What would settle it

Run the framework on a real smart-home setup, capture both the uplink and the downlink, and train a classifier on downlink-only features such as packet lengths, inter-arrival times, and flow counts; if that classifier recovers near-baseline identification accuracy while uplink features are scrambled, the paper's resilience claim is contradicted.

Watch

Extended reading notes

Core claim

The paper's central claim is that a suite of six reversible obfuscation transformations, applied with randomly varied parameters, destroys the stable traffic signatures that machine-learning classifiers rely on to identify IoT devices and infer activity. In the reported experiments, classifier accuracy on original traffic is near 99% on two datasets and above 90% on the third, while obfuscated traffic drops to roughly 5–35% for the strongest techniques and remains far below baseline even after neural-network incremental training and fine-tuning. The authors interpret this as evidence that the framework is resilient against adaptive adversaries because the random variation of padding sizes, fragment splits, XOR keys, shift amounts, and delays prevents a retrained model from locking onto a consistent pattern.

Load-bearing premise

The load-bearing premise is that changing only the traffic leaving the home—while the Wi-Fi sniffer in the threat model can also see traffic coming back from servers—is enough to stop device and activity identification; if the untouched downlink still leaks signatures, the privacy enhancement is incomplete.

Editorial extensions

If this is right

  • A home gateway running the framework could reduce the accuracy of passive device-identification attacks that rely on packet lengths, flow statistics, and timing.
  • Users could choose an obfuscation level, trading added bytes and latency against the residual accuracy a traffic-analysis classifier can achieve.
  • Adaptive attacks that retrain on obfuscated traffic would recover only part of the lost accuracy, according to the reported neural-network experiments.
  • The framework's public-dataset evaluations suggest the effect is not limited to a single home setup, at least across the three tested corpora.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension follows directly from the paper's own threat model: obfuscate or shape server-to-device traffic too, since an adversary who sees both directions could otherwise learn from the untouched downlink; the paper's implementation intercepts only outgoing traffic.
  • The adaptive-attack evaluation covers neural-network retraining and fine-tuning; an editor's inference is that testing adaptive versions of the other classifiers, and of sequence-based deep models, would map the boundary of the resilience claim.
  • Neighboring work on traffic morphing suggests that randomization alone may leave distributional fingerprints, such as new pairwise timing correlations introduced by delays; an informed adversary could try to model those, which is outside the paper's experiments.
  • Because the recovery header must be readable by the authorized server, a natural deployment question is how the header and shared obfuscation parameters are protected from an on-path Wi-Fi sniffer.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a multi-technique traffic obfuscation framework for IoT privacy, implemented on a Raspberry Pi, that applies six techniques (Padding, Padding+XORing, Padding+Shifting, Constant Size Padding, Fragmentation, and Delay Randomization) to outgoing IoT traffic. The authors evaluate the framework on three public datasets with five classifiers, reporting large drops in accuracy, precision, recall, and F1, and further show that retraining and fine-tuning a neural network on obfuscated traffic still yields degraded performance. They also report communication and system overhead. The central claim is that the framework effectively protects against traffic analysis attacks by the adversaries defined in Section III, including adaptive adversaries who retrain on obfuscated data.

Significance. If the central claim were established, the paper would be a useful empirical comparison of multiple obfuscation techniques under a common evaluation setup, with the welcome property that the adaptive-retraining experiments are non-tautological. The measurements themselves appear to be genuine and the paper is transparent about its setup. However, the design as described does not address its own threat model: only outgoing traffic is obfuscated, while the Wi-Fi sniffer observes both directions, and the recovery header placed in every packet reveals the obfuscation parameters to any observer who knows the framework. These are load-bearing gaps, not presentation issues, so the empirical accuracy drops do not substantiate the privacy claim.

major comments (3)
  1. [Section IV-A2 and Section III] The system only obfuscates outgoing traffic: Section IV-A2 states that the Raspberry Pi 'intercepts and processes all outgoing traffic from the IoT devices,' and Section V-A describes capturing traffic originating from the network. The threat model in Section III, however, explicitly includes a Wi-Fi sniffer that 'can see the MAC addresses of all devices communicating over Wi-Fi' and can analyze 'the timing and size of packets,' i.e., both device-to-server and server-to-device traffic. Server-to-device packets never pass through the obfuscation middlebox, so their sizes, timing, and direction remain unmodified. An adversary can fingerprint devices and infer activities from the inbound direction alone, or use inbound patterns to disambiguate the obfuscated outbound direction. The paper itself acknowledges this requirement in Section II-B: 'Effective obfuscation must alter network traffic in both directions between IoT devices and servers.' The evaluation never tests a bidirectional setting, so the reported accuracy reductions do not support the claim that a deployed middlebox provides the stated privacy enhancement against the Section III adversaries.
  2. [Section IV-A3 and Table II] The recovery header described in Section IV-A3 contains the Obfuscation Technique ID, padding lengths, XOR keys, shift amounts, and fragment sequence numbers, and its position is 'dynamically determined by a predetermined algorithm using packet metadata.' This means every obfuscated packet carries within itself the complete recipe for reversing the obfuscation. An adversary who knows the framework—precisely the adaptive adversary considered in Section V-A—can parse this header, reverse the transformations, and then apply ordinary traffic analysis to the recovered packets. The 'Incremental Training' and 'Fine-Tuning' rows in Table II measure performance against an adversary who retrains on obfuscated data without using the deobfuscation information that the packets expose. The claimed resilience against adaptive attackers is therefore not established; the results reflect an artificially weakened adversary.
  3. [Section V-A, Section VI-B, and Table II] The initial evaluation scenario assumes that 'the observer was unaware of the specifics of the obfuscation framework,' which is a weaker adversary than the Section III threat model of an adversary with prior knowledge of devices and offline training. For that scenario, the accuracy drops in Table II are partly definitional: a classifier trained on the original distribution will naturally degrade when tested on a transformed distribution, regardless of whether the transformation provides any privacy. The adaptive-retraining rows are the non-tautological evidence, but they are undermined by the recovery-header issue above. In addition, Section VI-B's adaptive test for Constant Size Padding replaces the technique's own parameter (the constant size) with a random delay added during retraining, so that particular experiment does not measure adaptation to the same technique. These issues together mean the paper's central claim is not supported by the experiments as designed.
minor comments (4)
  1. [Table III] The CPU usage values (0.0002% to 0.002%) and memory values (0.009 to 0.025 MB) seem implausibly low for packet processing on a Raspberry Pi; please clarify the measurement method, the units, and whether these figures are per packet or per batch.
  2. [Table IV] Several confidence intervals in Table IV are reported with standard deviations on the order of 1e-6 and means rounded to two decimals, which produces intervals that do not match the corresponding rounded point estimates in Table II (e.g., Neural Network 'None' accuracy is 95.15% in Table IV but 94.00% in Table II). Please reconcile the reporting or specify the rounding convention.
  3. [Section II-B] Section II-B states that existing obfuscation methods 'primarily alter traffic from IoT devices, neglecting incoming server traffic, which allows successful inference of IoT activities,' but the proposed framework itself only alters outgoing traffic. This internal contradiction should be addressed explicitly, since the paper's own literature review identifies the exact gap that the proposed system does not close.
  4. [Section VI-B] The adaptive parameter choices are reported as ranges (1-256 bytes, 1-128 bytes, 0.01-0.1 s, 0.01-0.2 s) without a sensitivity analysis. The reported accuracy drops are specific to these choices, and the paper would be stronger if it showed how the metrics vary across the range rather than at two discrete settings.

Circularity Check

1 steps flagged · score 2.0 of 10

No significant circularity: the non-adaptive accuracy drop is partly definitional because classifiers are trained on original traffic and tested on modified traffic, but the adaptive retraining/fine-tuning experiments and multi-dataset evaluation provide independent evidence; the only self-citation (IoT-AD dataset [39]) is not load-bearing.

  1. self definitional [Section V-A / Fig. 1 caption]
    "The significant drop in accuracy in classifying the obfuscated traffic highlights the effectiveness of our obfuscation framework. ... After applying the six obfuscation techniques to the IoT traffic, we test the trained models against the obfuscated traffic to measure their performance."

    The framework's effectiveness is operationally defined as lowering classifier metrics (Section IV-A: 'by reducing machine learning-based traffic analysis evaluation metrics'). The unaware-observer evaluation trains classifiers on original traffic and tests on obfuscated traffic, so the measured drop is a by-construction consequence of applying any feature-altering transformation to the test set, not an independently derived property. However, the adaptive rows (Incremental Training, Fine-Tuning in Table II) test models trained on obfuscated traffic with new obfuscation parameters, which is non-tautological; the multi-dataset breadth also provides external content. The self-citation to dataset [39] is non-load-bearing.

full rationale

This is an empirical systems paper rather than a derivation chain, so most circularity patterns do not apply. No parameter is fitted and then renamed as a prediction, no uniqueness theorem is imported from prior work, and no ansatz is smuggled in through a citation. The only self-citation is the public IoT-AD dataset [39], co-authored by one of the present authors; it is used as one of three independent datasets and is externally falsifiable, so it does not carry the paper's argument. The non-adaptive accuracy drop in Fig. 1 and Table II is partly definitional, since a classifier trained on original traffic will naturally lose accuracy when tested on traffic whose size and timing features have been deliberately changed; this is captured in the single flagged step. The independent content lies in the adaptive evaluation: models retrained and fine-tuned on obfuscated traffic still show degraded metrics, which is not guaranteed by construction. The paper's own limitation that effective obfuscation must alter both directions (Section II-B) while the prototype only intercepts outgoing traffic (Section IV-A2) is a correctness and threat-model gap, not a circularity, and does not affect the circularity score.

Assumptions & free parameters 5 free parameters · 3 assumptions · 1 invented entities

The evaluation depends on several hand-chosen obfuscation parameter ranges, and the central privacy claim rests on the unproven assumption that the recovery header cannot be exploited by an adversary. The paper also assumes that replayed pcaps represent real IoT traffic and that the chosen features capture the information leakage. No new physical entities are introduced; the only invented component is the recovery header, whose security is not independently evidenced.

free parameters (5)
  • Padding byte range (initial obfuscation) = 1-256 bytes
    Chosen by hand to obscure packet sizes; listed in Section VI-B. The reported accuracy drops depend on this range, and a different range would change results.
  • Padding byte range (adaptive testing) = 1-128 bytes
    Used for incremental training and fine-tuning tests in Section VI-B. Changing parameters between training and testing inflates the apparent robustness against adaptive adversaries.
  • Delay range (initial obfuscation) = 0.01-0.1 seconds
    Hand-chosen delay range for Delay Randomization; listed in Section VI-B. Latency and accuracy effects depend on this range.
  • Delay range (adaptive testing) = 0.01-0.2 seconds
    Expanded delay range used when testing retrained models; this parameter shift contributes to the observed accuracy drop.
  • Number of fragments = 2
    Fragmentation divides packets randomly into two parts; the number of fragments is a design choice that affects both overhead and classifier degradation.
assumptions (3)
  • ad hoc to paper The recovery header position and format remain unknown to adversaries.
    Section IV-A3 states that the header position is determined by a 'predetermined algorithm using packet metadata' and assumes this prevents adversaries from locating it. No security analysis is provided, and the header contains the exact parameters needed to reverse the obfuscation.
  • domain assumption Replaying pcap files on a local network faithfully reproduces real IoT traffic characteristics.
    Section V describes replaying packet captures with Scapy instead of using live devices. Timing, bidirectional flow, and device behavior may differ in replay, which could affect classifier baselines and obfuscation results.
  • domain assumption The selected traffic features (packet length, timing, flow features) are sufficient for the adversary's device identification task.
    Section IV-C selects features using ANOVA, and the classifiers achieve above 99% accuracy on original data. The threat model relies on these features being the leakage channel, which is consistent with prior work but is an assumption inherited from the cited literature.
invented entities (1)
  • Recovery header with Obfuscation Technique ID and per-packet metadata
    purpose: Allows the receiver to reverse obfuscation and recover original packets.
    The paper introduces this header in Section IV-A3. Its security is assumed rather than demonstrated; because the header is transmitted with each packet, any observer who can parse it could strip padding and recover original sizes, undermining the privacy claim.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hiding in Plain Sight: An IoT Traffic Camouflage Framework for Enhanced Privacy." pith.science (2026). https://pith.science/paper/EMDMTRR6

@misc{pith2026250115395,
  author       = {Pith},
  title        = {Pith review of: Hiding in Plain Sight: An IoT Traffic Camouflage Framework for Enhanced Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EMDMTRR6}},
  note         = {Machine review of arXiv:2501.15395}
}
read the original abstract

The rapid growth of Internet of Things (IoT) devices has introduced significant challenges to privacy, particularly as network traffic analysis techniques evolve. While encryption protects data content, traffic attributes such as packet size and timing can reveal sensitive information about users and devices. Existing single-technique obfuscation methods, such as packet padding, often fall short in dynamic environments like smart homes due to their predictability, making them vulnerable to machine learning-based attacks. This paper introduces a multi-technique obfuscation framework designed to enhance privacy by disrupting traffic analysis. The framework leverages six techniques-Padding, Padding with XORing, Padding with Shifting, Constant Size Padding, Fragmentation, and Delay Randomization-to obscure traffic patterns effectively. Evaluations on three public datasets demonstrate significant reductions in classifier performance metrics, including accuracy, precision, recall, and F1 score. We assess the framework's robustness against adversarial tactics by retraining and fine-tuning neural network classifiers on obfuscated traffic. The results reveal a notable degradation in classifier performance, underscoring the framework's resilience against adaptive attacks. Furthermore, we evaluate communication and system performance, showing that higher obfuscation levels enhance privacy but may increase latency and communication overhead.

Figures

Figures reproduced from arXiv: 2501.15395 by the authors.

Figure 1
Figure 1. Accuracy of machine learning models for IoT device [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Obfuscation Techniques against Traffic Classification [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. System Design difficult for adversaries to conduct accurate analysis. In the absence of encryption, the random shifting further obscures the content, providing strong protection against unauthorized inspection and analysis. • Constant Size Padding: This method pads all packets to a uniform size based on the largest packet in the traffic. For example, if the largest packet is 100 bytes, all packets are padded to matc… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 37 canonical work pages

  1. [1]

    Iot traffic obfuscation: Will it guarantee the privacy of your smart home?

    Y . Perera, N. Ahmed, S. Kanhere, W. Hu, and S. Jha, “Iot traffic obfuscation: Will it guarantee the privacy of your smart home?” in ICC 2022-IEEE International Conference on Communications. IEEE, 2022, pp. 2954–2959

    work page 2022

  2. [2]

    Understanding the mirai botnet,

    M. Antonakakis, T. April, M. Bailey, M. Bernhard, E. Bursztein, J. Cochran, Z. Durumeric, J. A. Halderman, L. Invernizzi, M. Kallitsis et al. , “Understanding the mirai botnet,” in 26th USENIX security symposium (USENIX Security 17) , 2017, pp. 1093–1110

    work page 2017

  3. [3]

    Characterizing and classifying iot traffic in smart cities and campuses,

    A. Sivanathan, D. Sherratt, H. H. Gharakheili, A. Radford, C. Wi- jenayake, A. Vishwanath, and V . Sivaraman, “Characterizing and classifying iot traffic in smart cities and campuses,” in 2017 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 2017, pp. 559–564

    work page 2017

  4. [4]

    Profiliot: A machine learning approach for iot device identification based on network traffic analysis,

    Y . Meidan, M. Bohadana, A. Shabtai, J. D. Guarnizo, M. Ochoa, N. O. Tippenhauer, and Y . Elovici, “Profiliot: A machine learning approach for iot device identification based on network traffic analysis,” in Proceedings of the symposium on applied computing, 2017, pp. 506– 509

    work page 2017

  5. [5]

    Homonit: Monitoring smart home apps from encrypted traffic,

    W. Zhang, Y . Meng, Y . Liu, X. Zhang, Y . Zhang, and H. Zhu, “Homonit: Monitoring smart home apps from encrypted traffic,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 1074–1088

    work page 2018

  6. [6]

    Fingerprinting encrypted voice traffic on smart speakers with deep learning,

    C. Wang, S. Kennedy, H. Li, K. Hudson, G. Atluri, X. Wei, W. Sun, and B. Wang, “Fingerprinting encrypted voice traffic on smart speakers with deep learning,” in Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2020, pp. 254– 265

    work page 2020

  7. [7]

    Attacking and protecting tunneled traffic of smart home devices,

    A. Alshehri, J. Granley, and C. Yue, “Attacking and protecting tunneled traffic of smart home devices,” in Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy , 2020, pp. 259–270

    work page 2020

  8. [8]

    Peek-a-boo: I see your smart home activities, even encrypted!

    A. Acar, H. Fereidooni, T. Abera, A. K. Sikder, M. Miettinen, H. Aksu, M. Conti, A.-R. Sadeghi, and S. Uluagac, “Peek-a-boo: I see your smart home activities, even encrypted!” in Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2020, pp. 207–218

    work page 2020

Show all 42 references
  1. [9]

    Keeping the smart home private with smart (er) iot traffic shaping,

    N. Apthorpe, D. Y . Huang, D. Reisman, A. Narayanan, and N. Feam- ster, “Keeping the smart home private with smart (er) iot traffic shaping,” arXiv preprint arXiv:1812.00955 , 2018

    2018 arXiv

  2. [10]

    Privacy-preserving encrypted traffic inspection with symmetric cryptographic techniques in iot,

    D. Chen, H. Wang, N. Zhang, X. Nie, H.-N. Dai, K. Zhang, and K.-K. Raymond Choo, “Privacy-preserving encrypted traffic inspection with symmetric cryptographic techniques in iot,” IEEE Internet of Things Journal, vol. 9, no. 18, pp. 17 265–17 279, 2022

    2022

  3. [11]

    Black routing and node obscuring in iot,

    S. Chakrabarty, M. John, and D. W. Engels, “Black routing and node obscuring in iot,” in 2016 IEEE 3rd World Forum on Internet of Things (WF-IoT), 2016, pp. 323–328

    2016

  4. [12]

    Privacy-preserving using homomorphic encryption in mobile iot systems,

    W. Ren, X. Tong, J. Du, N. Wang, S. C. Li, G. Min, Z. Zhao, and A. K. Bashir, “Privacy-preserving using homomorphic encryption in mobile iot systems,” Computer Communications , vol. 165, pp. 105–111, 2021. [Online]. Available: https://www.sciencedirect.com/ science/article/pii...

    2021

  5. [13]

    Blindbox: Deep packet inspection over encrypted traffic

    J. Sherry, C. Lan, R. A. Popa, and S. Ratnasamy, “Blindbox: Deep packet inspection over encrypted traffic.” New York, NY , USA: Association for Computing Machinery, 2015. [Online]. Available: https://doi.org/10.1145/2785956.2787502

    2015

  6. [14]

    Embark: Securely outsourcing middleboxes to the cloud,

    C. Lan, J. Sherry, R. A. Popa, S. Ratnasamy, and Z. Liu, “Embark: Securely outsourcing middleboxes to the cloud,” in 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16). Santa Clara, CA: USENIX Association, Mar. 2016, pp. 255–

    2016

  7. [15]

    Iot device fingerprinting: Machine learning based encrypted traffic analysis,

    N. Msadek, R. Soua, and T. Engel, “Iot device fingerprinting: Machine learning based encrypted traffic analysis,” in 2019 IEEE wireless communications and networking conference (WCNC) . IEEE, 2019, pp. 1–8

    2019

  8. [16]

    Spying on the smart home: Privacy attacks and defenses on encrypted iot traffic,

    N. Apthorpe, D. Reisman, S. Sundaresan, A. Narayanan, and N. Feam- ster, “Spying on the smart home: Privacy attacks and defenses on encrypted iot traffic,” arXiv preprint arXiv:1708.05044 , 2017

    2017 arXiv

  9. [17]

    A smart home is no castle: Privacy vulnerabilities of encrypted iot traffic,

    N. Apthorpe, D. Reisman, and N. Feamster, “A smart home is no castle: Privacy vulnerabilities of encrypted iot traffic,” arXiv preprint arXiv:1705.06805, 2017

    2017 arXiv

  10. [18]

    Classification of encrypted iot traffic despite padding and shaping,

    A. Engelberg and A. Wool, “Classification of encrypted iot traffic despite padding and shaping,” in Proceedings of the 21st Workshop on Privacy in the Electronic Society , ser. WPES’22. New York, NY , USA: Association for Computing Machinery, 2022, p. 1–13. [Online]. Available...

    2022

  11. [19]

    Packet padding for improving privacy in consumer iot,

    A. J. Pinheiro, J. M. Bezerra, and D. R. Campelo, “Packet padding for improving privacy in consumer iot,” in 2018 IEEE Symposium on Computers and Communications (ISCC) , 2018, pp. 00 925–00 929

    2018

  12. [20]

    A developer-friendly library for smart home iot privacy-preserving traffic obfuscation,

    T. Datta, N. Apthorpe, and N. Feamster, “A developer-friendly library for smart home iot privacy-preserving traffic obfuscation,” in Proceed- ings of the 2018 workshop on IoT security and privacy , 2018, pp. 43–48

    2018

  13. [21]

    Defending against packet-size side-channel attacks in iot networks,

    S. Xiong, A. D. Sarwate, and N. B. Mandayam, “Defending against packet-size side-channel attacks in iot networks,” in 2018 IEEE In- ternational Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2018, pp. 2027–2031

    2018

  14. [22]

    A survey of traffic obfuscation technology for smart home,

    F. Shen, S. Zhang, Y . Liu, and Z. Yang, “A survey of traffic obfuscation technology for smart home,” in 2022 International Wireless Commu- nications and Mobile Computing (IWCMC) , 2022, pp. 997–1002

    2022

  15. [23]

    A survey on smart home privacy data protection technology,

    B. Chen, Y . Liu, S. Zhang, J. Chen, and Z. Han, “A survey on smart home privacy data protection technology,” in 2021 IEEE Sixth International Conference on Data Science in Cyberspace (DSC), 2021, pp. 583–590

    2021

  16. [24]

    Peek-a-boo, i still see you: Why efficient traffic analysis countermeasures fail,

    K. P. Dyer, S. E. Coull, T. Ristenpart, and T. Shrimpton, “Peek-a-boo, i still see you: Why efficient traffic analysis countermeasures fail,” in 2012 IEEE Symposium on Security and Privacy , 2012, pp. 332–346

    2012

  17. [25]

    Adaptive packet padding approach for smart home networks: A tradeoff between privacy and performance,

    A. J. Pinheiro, P. Freitas de Araujo-Filho, J. de M. Bezerra, and D. R. Campelo, “Adaptive packet padding approach for smart home networks: A tradeoff between privacy and performance,” IEEE Internet of Things Journal , vol. 8, no. 5, pp. 3930–3938, 2021

    2021

  18. [26]

    Defending against traffic analysis in wireless networks through traffic reshaping,

    F. Zhang, W. He, and X. Liu, “Defending against traffic analysis in wireless networks through traffic reshaping,” in2011 31st International Conference on Distributed Computing Systems , 2011, pp. 593–602

    2011

  19. [27]

    Attacking and protecting tunneled traffic of smart home devices,

    A. Alshehri, J. Granley, and C. Yue, “Attacking and protecting tunneled traffic of smart home devices,” in Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, ser. CODASPY ’20. New York, NY , USA: Association for Computing Machinery, 2020, p. ...

    2020

  20. [28]

    The dark (and bright) side of iot: Attacks and countermeasures for identifying smart home devices and services,

    A. M. Hussain, G. Oligeri, and T. V oigt, “The dark (and bright) side of iot: Attacks and countermeasures for identifying smart home devices and services,” in Security, Privacy, and Anonymity in Computation, Communication, and Storage: SpaCCS 2020 International Workshops, Nanj...

    2020

  21. [29]

    A defense mechanism for timing-based side-channel attacks on iot traffic,

    N. Prates, A. Verg ¨utz, R. T. Macedo, A. Santos, and M. Nogueira, “A defense mechanism for timing-based side-channel attacks on iot traffic,” in GLOBECOM 2020 - 2020 IEEE Global Communications Conference, 2020, pp. 1–6

    2020

  22. [30]

    Protecting iot- environments against traffic analysis attacks with traffic morphing,

    I. Hafeez, M. Antikainen, and S. Tarkoma, “Protecting iot- environments against traffic analysis attacks with traffic morphing,” in 2019 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops), 2019, pp. 196–201

    2019

  23. [31]

    Smart home: Keeping privacy based on air-padding,

    Q. Zhu, C. Yang, Y . Zheng, J. Ma, H. Li, J. Zhang, and J. Shao, “Smart home: Keeping privacy based on air-padding,” IET Information Security, vol. 15, no. 2, pp. 156–168, 2021

    2021

  24. [32]

    Preserving contextual privacy for smart home iot devices with dynamic traffic shaping,

    J. Brahma and D. Sadhya, “Preserving contextual privacy for smart home iot devices with dynamic traffic shaping,” IEEE Internet of Things Journal, vol. 9, no. 13, pp. 11 434–11 441, 2022

    2022

  25. [33]

    Closing the blinds: Four strategies for protecting smart home privacy from network observers,

    N. Apthorpe, D. Reisman, and N. Feamster, “Closing the blinds: Four strategies for protecting smart home privacy from network observers,” arXiv preprint arXiv:1705.06809 , 2017

    2017 arXiv

  26. [34]

    Privacy leakage in smart homes and its mitigation: Ifttt as a case study,

    R. Xu, Q. Zeng, L. Zhu, H. Chi, X. Du, and M. Guizani, “Privacy leakage in smart homes and its mitigation: Ifttt as a case study,” IEEE Access, vol. 7, pp. 63 457–63 471, 2019

    2019

  27. [35]

    Pinball: Universal and robust signature extraction for smart home devices,

    C. Duan, S. Zhang, J. Yang, Z. Wang, Y . Yang, and J. Li, “Pinball: Universal and robust signature extraction for smart home devices,” in 2021 IFIP/IEEE International Symposium on Integrated Network Management (IM), 2021, pp. 1–9

    2021

  28. [36]

    A novel traffic obfuscation technology for smart home,

    S. Zhang, F. Shen, Y . Liu, Z. Yang, and X. Lv, “A novel traffic obfuscation technology for smart home,” Electronics, vol. 12, no. 16, p. 3477, 2023

    2023

  29. [37]

    Pingpong: Packet-level signatures for smart home device events,

    R. Trimananda, J. Varmarken, A. Markopoulou, and B. Demsky, “Pingpong: Packet-level signatures for smart home device events,” arXiv preprint arXiv:1907.11797 , 2019

    1907 arXiv

  30. [38]

    Transferability of machine learning algorithm for iot device profiling and identification,

    P. K. Danso, S. Dadkhah, E. C. P. Neto, A. Zohourian, H. Molyneaux, R. Lu, and A. A. Ghorbani, “Transferability of machine learning algorithm for iot device profiling and identification,” IEEE Internet of Things Journal , 2023

    2023

  31. [39]

    Iot-ad: A framework to detect anomalies among interconnected iot devices,

    H. Zahan, M. W. Al Azad, I. Ali, and S. Mastorakis, “Iot-ad: A framework to detect anomalies among interconnected iot devices,” IEEE Internet of Things Journal , vol. 11, no. 1, pp. 478–489, 2023

    2023

  32. [40]

    Iot sentinel: Automated device-type identification for security enforcement in iot,

    M. Miettinen, S. Marchal, I. Hafeez, N. Asokan, A.-R. Sadeghi, and S. Tarkoma, “Iot sentinel: Automated device-type identification for security enforcement in iot,” in 2017 IEEE 37th international conference on distributed computing systems (ICDCS) . IEEE, 2017, pp. 2177–2184

    2017

  33. [41]

    Classifying iot devices in smart environments using network traffic characteristics,

    A. Sivanathan, H. H. Gharakheili, F. Loi, A. Radford, C. Wijenayake, A. Vishwanath, and V . Sivaraman, “Classifying iot devices in smart environments using network traffic characteristics,” IEEE Transactions on Mobile Computing , vol. 18, no. 8, pp. 1745–1759, 2018. APPENDIX T...

    2018

  34. [273]

    Available: https://www.usenix.org/conference/nsdi16/ technical-sessions/presentation/lan

    [Online]. Available: https://www.usenix.org/conference/nsdi16/ technical-sessions/presentation/lan

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.