arXiv subjects

Fabio Palmese

Publications and source records attributed to Fabio Palmese.

12 recordsLinked to original sources

arXiv2026

CERTIoT-6G: Continuous Cybersecurity Certification for IoT Devices in 5G/6G Networks

The massive adoption of Internet of Things (IoT) devices across critical domains such as healthcare, smart cities, industrial automation, and critical infrastructure introduces significant cybersecurity and regulatory challenges. Current and forthcoming European regulations, including the Cyber Resilience Act (CRA) and the NIS2 Directive, require manufacturers, operators, and other organizations to ensure secure-by-design devices, continuous vulnerability management, and resilient operation throughout the device lifecycle. Traditional certification mechanisms remain static, manual, and difficult to scale across heterogeneous IoT ecosystems. This paper presents CERTIoT-6G, a Security-as-a-Service (SECaaS) framework that enables automated cybersecurity certification and continuous compliance monitoring of IoT devices operating in 5G and future 6G networks. The framework integrates automated compliance analysis, real-time traffic monitoring, and adversarial testing capabilities. We validate the CERTIoT-6G framework on different IoT device categories operating in an advanced 5G testbed. Evaluation results reveal critical compliance gaps, particularly in traffic encryption and availability under unstable conditions, and demonstrate that the framework produces actionable verdicts mapped to regulatory requirements across heterogeneous device types. Furthermore, we show that the monitoring pipeline has a negligible impact on live 5G traffic.

cs.NI↗

arXiv2026

Early-Stage IoT Device Identification Using Passive Network Traffic Analysis

The rapid proliferation of Internet of Things (IoT) devices introduces significant security challenges due to limited visibility and weak device-level guarantees. Accurate and timely identification of devices is essential for enforcing network policies and detecting unauthorised hardware, yet existing approaches often rely on long-term traffic observation, payload inspection, or infrastructure-dependent features. In this paper, we investigate whether IoT devices can be reliably identified during the early stages of network attachment using only passive traffic analysis. We propose a lightweight approach based on flow-level features extracted from metadata, avoiding payload inspection and active probing. Through systematic evaluation across multiple observation windows, we show that device-specific signatures emerge within the first few seconds of communication, enabling high-accuracy identification (up to 99%) across 37 IoT devices. Notably, extending the observation window does not consistently improve performance and may slightly degrade accuracy, indicating that the most discriminative behaviour occurs during initial device startup. These findings demonstrate the feasibility of fast, privacy-preserving IoT device identification at the network edge, supporting real-time enforcement, device inventory, and anomaly detection in practical deployments.

cs.NI↗

arXiv2026

Zigbee vs. Matter over Thread: Understanding IoT Protocol Performance in Practice

The widespread adoption of the Internet of Things (IoT) has positioned smart homes as paradigmatic examples of distributed automation systems, where reliability, efficiency, and interoperability depend critically on the underlying communication protocol. Among the low-power wireless technologies available for this scenario, Zigbee and Matter over Thread have emerged as leading contenders. While Zigbee represents a mature, non-IP mesh networking solution, Matter over Thread introduces an IP-based architecture designed to unify device interoperability across different ecosystems. However, despite extensive documentation of their design principles, there is a lack of empirical, comparative performance data under realistic network conditions. This paper presents a comprehensive experimental comparison between the two protocols, conducted on a testbed built from commercially available hardware. The proposed methodology focuses on different key performance dimensions, such as scalability, responsiveness, and fault tolerance. The results reveal that Zigbee achieves a lower baseline overhead and faster route recovery, making it more responsive in static small-scale deployments. Matter over Thread, conversely, exhibits superior scalability and robustness, maintaining stable throughput and predictable latency across multi-hop scenarios. Overall, we highlight that Zigbee and Matter over Thread embody distinct trade-offs between agility, efficiency, and scalability.

cs.NI↗

arXiv2026

Lossy Compression of Network Feature Data: When Less Is Enough

Network traffic analysis increasingly relies on feature-based representations to support monitoring and security in the presence of pervasive encryption. Although features are more compact than raw packet traces, their storage has become a scalability bottleneck from large-scale core networks to resource-constrained Internet of Things (IoT) environments. This article investigates task-aware lossy compression strategies that reduce the storage footprint of traffic features while preserving analytics accuracy. Using website classification in core networks and device identification in IoT environments as representative use cases, we show that simple, semantics-preserving compression techniques expose stable operating regions that balance storage efficiency and task performance. These results highlight compression as a first-class design dimension in scalable network monitoring systems.

cs.NI↗

arXiv2026

Analyzing Zigbee Traffic: Datasets, Classification and Storage Trade-offs

Zigbee is widely used in smart home environments due to its low power consumption and support for mesh networking, making it a relevant target for traffic-based IoT forensic analysis. However, existing studies often rely on limited datasets and fixed network configurations. In this paper, we analyze Zigbee network traffic from three complementary perspectives: data collection, traffic classification, and storage efficiency. We introduce ZIOTP2025, a publicly available dataset of Zigbee traffic collected from commercial smart home devices deployed under multiple network configurations and capturing realistic interaction scenarios. Using this dataset, we study two traffic classification tasks: device type classification and individual device identification, and evaluate their robustness under both intra-configuration and cross-configuration settings. Our results show that while high classification accuracy can be achieved under controlled conditions, performance degrades significantly when models are evaluated across different network configurations, particularly for fine-grained identification tasks. Finally, we investigate the trade-off between traffic storage requirements and classification accuracy. We show that lossy compression of traffic features through quantization can reduce storage requirements by approximately 4-5x compared to lossless storage of raw packet traces, while preserving near-lossless classification performance. Overall, our results highlight the need for topology-aware Zigbee traffic analysis and storage-efficient feature compression to enable robust and scalable IoT forensic systems.

cs.NI↗

arXiv2026

Lossy Compression of Cellular Network KPIs

Network Key Performance Indicators (KPIs) are a fundamental component of mobile cellular network monitoring and optimization. Their massive volume, resulting from fine-grained measurements collected across many cells over long time horizons, poses significant challenges for storage, transport, and large-scale analysis. In this letter, we show that common cellular KPIs can be efficiently compressed using standard lossy compression schemes based on prediction, quantization, and entropy coding, achieving substantial reductions in reporting overhead. Focusing on traffic volume KPIs, we first characterize their intrinsic compressibility through a rate-distortion analysis, showing that signal-to-noise ratios around 30 dB can be achieved using only 3-4 bits per sample, corresponding to an 8-10x reduction with respect to 32-bit floating-point representations. We then assess the impact of KPI compression on representative downstream analytics tasks. Our results show that aggregation across cells mitigates quantization errors and that prediction accuracy is unaffected beyond a moderate reporting rate. These findings indicate that KPI compression is feasible and transparent to network-level analytics in cellular systems.

cs.NI↗

arXiv2025

Efficient Wi-Fi Sensing for IoT Forensics with Lossy Compression of CSI Data

Wi-Fi sensing is an emerging technology that uses channel state information (CSI) from ambient Wi-Fi signals to monitor human activity without the need for dedicated sensors. Wi-Fi sensing does not only represent a pivotal technology in intelligent Internet of Things (IoT) systems, but it can also provide valuable insights in forensic investigations. However, the high dimensionality of CSI data presents major challenges for storage, transmission, and processing in resource-constrained IoT environments. In this paper, we investigate the impact of lossy compression on the accuracy of Wi-Fi sensing, evaluating both traditional techniques and a deep learning-based approach. Our results reveal that simple, interpretable techniques based on principal component analysis can significantly reduce the CSI data volume while preserving classification performance, making them highly suitable for lightweight IoT forensic scenarios. On the other hand, deep learning models exhibit higher potential in complex applications like activity recognition (achieving compression ratios up to 16000:1 with minimal impact on sensing performance) but require careful tuning and greater computational resources. By considering two different sensing applications, this work demonstrates the feasibility of integrating lossy compression schemes into Wi-Fi sensing pipelines to make intelligent IoT systems more efficient and improve the storage requirements in forensic applications.

cs.NI↗

arXiv2025

Handling Large-Scale Network Flow Records: A Comparative Study on Lossy Compression

Flow records, that summarize the characteristics of traffic flows, represent a practical and powerful way to monitor a network. While they already offer significant compression compared to full packet captures, their sheer volume remains daunting, especially for large Internet Service Providers (ISPs). In this paper, we investigate several lossy compression techniques to further reduce storage requirements while preserving the utility of flow records for key tasks, such as predicting the domain name of contacted servers. Our study evaluates scalar quantization, Principal Component Analysis (PCA), and vector quantization, applied to a real-world dataset from an operational campus network. Results reveal that scalar quantization provides the best tradeoff between compression and accuracy. PCA can preserve predictive accuracy but hampers subsequent entropic compression, and while vector quantization shows promise, it struggles with scalability due to the high-dimensional nature of the data. These findings result in practical strategies for optimizing flow record storage in large-scale monitoring scenarios.

cs.NI↗

arXiv2025

Intelligent Detection of Non-Essential IoT Traffic on the Home Gateway

The rapid expansion of Internet of Things (IoT) devices, particularly in smart home environments, has introduced considerable security and privacy concerns due to their persistent connectivity and interaction with cloud services. Despite advancements in IoT security, effective privacy measures remain uncovered, with existing solutions often relying on cloud-based threat detection that exposes sensitive data or outdated allow-lists that inadequately restrict non-essential network traffic. This work presents ML-IoTrim, a system for detecting and mitigating non-essential IoT traffic (i.e., not influencing the device operations) by analyzing network behavior at the edge, leveraging Machine Learning to classify network destinations. Our approach includes building a labeled dataset based on IoT device behavior and employing a feature-extraction pipeline to enable a binary classification of essential vs. non-essential network destinations. We test our framework in a consumer smart home setup with IoT devices from five categories, demonstrating that the model can accurately identify and block non-essential traffic, including previously unseen destinations, without relying on traditional allow-lists. We implement our solution on a home access point, showing the framework has strong potential for scalable deployment, supporting near-real-time traffic classification in large-scale IoT environments with hundreds of devices. This research advances privacy-aware traffic control in smart homes, paving the way for future developments in IoT device privacy.

cs.CR↗

arXiv2024

Compact Probe Request Fingerprinting with Asymmetric Pairwise Boosting

Probe Requests are Wi-Fi management frames periodically sent by devices during network discovery. Tracking Probe Requests over time offers insights into movement patterns, traffic flows, and behavior trends, which are keys in applications such as urban planning, human mobility analysis, and retail analytics. To protect user privacy, techniques such as MAC address randomization are employed, periodically altering device MAC addresses to limit tracking. However, research has shown that these privacy measures can be circumvented. By analyzing the Information Elements (IE) within the Probe Request body, it is possible to fingerprint devices and track users over time. This paper presents a machine learning-based approach for fingerprinting Wi-Fi Probe Requests in a compact fashion. We utilize Asymmetric Pairwise Boosting to learn discriminating filters which are then used to process specific bit sequences in Probe Request frames, and quantize the results into a compact binary format. Extensive evaluation on public datasets demonstrates a two-order-of-magnitude storage reduction compared to existing methods while maintaining robust fingerprinting performance.

cs.NI↗

arXiv2023

Collecting Channel State Information in Wi-Fi Access Points for IoT Forensics

The Internet of Things (IoT) has boomed in recent years, with an ever-growing number of connected devices and a corresponding exponential increase in network traffic. As a result, IoT devices have become potential witnesses of the surrounding environment and people living in it, creating a vast new source of forensic evidence. To address this need, a new field called IoT Forensics has emerged. In this paper, we present \textit{CSI Sniffer}, a tool that integrates the collection and management of Channel State Information (CSI) in Wi-Fi Access Points. CSI is a physical layer indicator that enables human sensing, including occupancy monitoring and activity recognition. After a description of the tool architecture and implementation, we demonstrate its capabilities through two application scenarios that use binary classification techniques to classify user behavior based on CSI features extracted from IoT traffic. Our results show that the proposed tool can enhance the capabilities of forensic investigations by providing additional sources of evidence. Wi-Fi Access Points integrated with \textit{CSI Sniffer} can be used by ISP or network managers to facilitate the collection of information from IoT devices and the surrounding environment. We conclude the work by analyzing the storage requirements of CSI sample collection and discussing the impact of lossy compression techniques on classification performance.

cs.NI↗

arXiv2023

Feature-Sniffer: Enabling IoT Forensics in OpenWrt based Wi-Fi Access Points

The Internet of Things is in constant growth, with millions of devices used every day in our homes and workplaces to ease our lives. Such a strict coexistence between humans and smart devices makes the latter digital witnesses of our every-day lives through their sensor systems. This opens up to a new area of digital investigation named IoT Forensics, where digital traces produced by smart devices (network traffic, in primis) are leveraged as evidences for forensic purposes. It is therefore important to create tools able to capture, store and possibly analyse easily such digital traces to ease the job of forensic investigators. This work presents one of such tools, named Feature-Sniffer, which is thought explicitly for Wi-Fi enabled smart devices used in Smart Building/Smart Home scenarios. Feature-Sniffer is an add-on for OpenWrt-based access points and allows to easily perform online traffic feature extraction, avoiding to store large PCAP files. We present Feature-Sniffer with an accurate description of the implementation details, and we show its possible uses with practical examples for device identification and activity classification from encrypted traffic produced by IoT cameras. We release Feature-Sniffer publicly for reproducible research.

cs.NI↗