Can Evil IoT Twins Be Identified? Now Yes, a Hardware Behavioral Fingerprinting Methodology

The connectivity and resource-constrained nature of IoT, and in particular single-board devices, opens up to cybersecurity concerns affecting the Industrial Internet of Things (IIoT). One of the most important is the presence of evil IoT twins. Evil IoT twins are malicious devices, with identical hardware and software configurations to authorized ones, that can provoke sensitive information leakages, data poisoning, or privilege escalation in industrial scenarios. Combining behavioral fingerprinting and Machine/Deep Learning (ML/DL) techniques is a promising solution to identify evil IoT twins by detecting minor performance differences generated by imperfections in manufacturing. However, existing solutions are not suitable for single-board devices because they do not consider their hardware and software limitations, underestimate critical aspects during the identification performance evaluation, and do not explore the potential of ML/DL techniques. Moreover, there is a dramatic lack of work explaining essential aspects to considering during the identification of identical devices. This work proposes an ML/DL-oriented methodology that uses behavioral fingerprinting to identify identical single-board devices. The methodology leverages the different built-in components of the system, comparing their internal behavior with each other to detect variations that occurred in manufacturing processes. The validation has been performed in a real environment composed of identical Raspberry Pi 4 Model B devices, achieving the identification for all devices by setting a 50% threshold in the evaluation process. Finally, a discussion compares the proposed solution with related work and provides important lessons learned and limitations.