The Forest Behind the Tree: Revealing Hidden Smart Home Communication Patterns via Strategic Traffic Blocking

Network-connected Smart Home devices are becoming increasingly common, creating potential security and privacy risks. Previous research has shown these devices follow predictable network communication patterns, allowing researchers to model their normal network behavior and detect potential security breaches. However, existing approaches only observe traffic passively rather than actively trying to disturb it. We present a framework that generates comprehensive network signatures for Smart Home devices by systematically blocking previously observed traffic patterns to reveal new, hidden patterns that other methods miss. These signatures are structured as behavior trees, where each child node represents network flows that occur when the parent node's traffic is blocked. We applied this framework on ten real-world devices under 26 usage scenarios, discovering 138 unique flows, of which 27 (20%) are information gained through our multi-level tree approach, compared to state-of-the-art single-level traffic analysis.

@article{keersmaeker2025_2502.08535,
  title={ The Forest Behind the Tree: Revealing Hidden Smart Home Communication Patterns },
  author={ François De Keersmaeker and Rémi Van Boxem and Cristel Pelsser and Ramin Sadre },
  journal={arXiv preprint arXiv:2502.08535},
  year={ 2025 }
}