  Understanding network traffic characteristics of IoT devices plays a critical
role in improving both the performance and security of IoT devices, including
IoT device identification, classification, and anomaly detection. Although a
number of existing research efforts have developed machine-learning based
algorithms to help address the challenges in improving the security of IoT
devices, none of them have provided detailed studies on the network traffic
characteristics of IoT devices. In this paper we collect and analyze the
network traffic generated in a typical smart homes environment consisting of a
set of common IoT (and non-IoT) devices. We analyze the network traffic
characteristics of IoT devices from three complementary aspects: remote network
servers and port numbers that IoT devices connect to, flow-level traffic
characteristics such as flow duration, and packet-level traffic characteristics
such as packet inter-arrival time. Our study provides critical insights into
the operational and behavioral characteristics of IoT devices, which can help
develop more effective security and performance algorithms for IoT devices.
