Fiden: Intelligent Fingerprint Learning for Attacker Identification in the Industrial Internet of Things

This article studies the attacker identification issue in the Industrial Internet of Things (IIoT). There have been already some work that uses device fingerprinting to identify attackers, and the transmission offset of the device internal clock signals is used as the device's fingerprint. However, the existing work to measure the offset relies on the periodic transmission of signals, but in many types of IIoT devices, the signal transmission is aperiodic. To eliminate the limitation on the periodicity, in this article, we design an algorithm, Fiden, to fingerprint heterogeneous IIoT devices without considering the periodicity. This algorithm extracts the patterns from the time series of signal transmission, and then learns the fingerprint of a device by clustering the patterns. We demonstrate the applicability of Fiden by a real case study on the communications environment of the vehicle industry. The results show that the proposed algorithm helps identify the devices-mounted attacks. Compared with the clock-based intrusion detection system (CIDS), when the timestamp and accumulated clock offset of the signal transmission are used as the features for pattern extraction, Fiden's accuracy is increased by 15{\%} and 15{\%} to these two features, precision is increased by 25{\%} and 23{\%}, recall is increased by 28{\%} and 18{\%}, and F1 score is increased by 28{\%} and 21{\%}.