{"id":"https://openalex.org/W7118441694","doi":"https://doi.org/10.1109/access.2026.3651297","title":"Behavioral Fingerprinting of IoT Devices for Forensic Identification Post-Attack","display_name":"Behavioral Fingerprinting of IoT Devices for Forensic Identification Post-Attack","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7118441694","doi":"https://doi.org/10.1109/access.2026.3651297"},"language":null,"primary_location":{"id":"doi:10.1109/access.2026.3651297","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3651297","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3651297","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5122250552","display_name":"Laveeza Tahir","orcid":null},"institutions":[{"id":"https://openalex.org/I4210102737","display_name":"Khwaja Fareed University of Engineering and Information Technology","ror":"https://ror.org/0161dyt30","country_code":"PK","type":"education","lineage":["https://openalex.org/I4210102737"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Laveeza Tahir","raw_affiliation_strings":["Institute of Information Technology, Khwaja Fareed University of Engineering and Information Technology, Rahim Yar Khan, Pakistan"],"raw_orcid":"https://orcid.org/0009-0000-0590-9385","affiliations":[{"raw_affiliation_string":"Institute of Information Technology, Khwaja Fareed University of Engineering and Information Technology, Rahim Yar Khan, Pakistan","institution_ids":["https://openalex.org/I4210102737"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122252005","display_name":"Isha Bukhari","orcid":null},"institutions":[{"id":"https://openalex.org/I4210102737","display_name":"Khwaja Fareed University of Engineering and Information Technology","ror":"https://ror.org/0161dyt30","country_code":"PK","type":"education","lineage":["https://openalex.org/I4210102737"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Isha Bukhari","raw_affiliation_strings":["Institute of Information Technology, Khwaja Fareed University of Engineering and Information Technology, Rahim Yar Khan, Pakistan"],"raw_orcid":"https://orcid.org/0009-0000-7383-2666","affiliations":[{"raw_affiliation_string":"Institute of Information Technology, Khwaja Fareed University of Engineering and Information Technology, Rahim Yar Khan, Pakistan","institution_ids":["https://openalex.org/I4210102737"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Kashif Munir","orcid":"https://orcid.org/0000-0001-5114-4213"},"institutions":[{"id":"https://openalex.org/I4210102737","display_name":"Khwaja Fareed University of Engineering and Information Technology","ror":"https://ror.org/0161dyt30","country_code":"PK","type":"education","lineage":["https://openalex.org/I4210102737"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Kashif Munir","raw_affiliation_strings":["Institute of Information Technology, Khwaja Fareed University of Engineering and Information Technology, Rahim Yar Khan, Pakistan"],"raw_orcid":"https://orcid.org/0000-0001-5114-4213","affiliations":[{"raw_affiliation_string":"Institute of Information Technology, Khwaja Fareed University of Engineering and Information Technology, Rahim Yar Khan, Pakistan","institution_ids":["https://openalex.org/I4210102737"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079466640","display_name":"Hasan J. Alyamani","orcid":"https://orcid.org/0000-0003-0522-4348"},"institutions":[{"id":"https://openalex.org/I185163786","display_name":"King Abdulaziz University","ror":"https://ror.org/02ma4wv74","country_code":"SA","type":"education","lineage":["https://openalex.org/I185163786"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Hasan J. Alyamani","raw_affiliation_strings":["Department of Information Systems, Faculty of Computing and Information Technology in Rabigh, King Abdulaziz University, Jeddah, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0003-0522-4348","affiliations":[{"raw_affiliation_string":"Department of Information Systems, Faculty of Computing and Information Technology in Rabigh, King Abdulaziz University, Jeddah, Saudi Arabia","institution_ids":["https://openalex.org/I185163786"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121963768","display_name":"Amine Bermak","orcid":null},"institutions":[{"id":"https://openalex.org/I4210144839","display_name":"Hamad bin Khalifa University","ror":"https://ror.org/03eyq4y97","country_code":"QA","type":"education","lineage":["https://openalex.org/I4210144839"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Amine Bermak","raw_affiliation_strings":["College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0003-4984-6093","affiliations":[{"raw_affiliation_string":"College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar","institution_ids":["https://openalex.org/I4210144839"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5053314319","display_name":"Atiq Ur Rehman","orcid":"https://orcid.org/0000-0003-0248-7919"},"institutions":[{"id":"https://openalex.org/I4210144839","display_name":"Hamad bin Khalifa University","ror":"https://ror.org/03eyq4y97","country_code":"QA","type":"education","lineage":["https://openalex.org/I4210144839"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Atiq Ur Rehman","raw_affiliation_strings":["College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0003-0248-7919","affiliations":[{"raw_affiliation_string":"College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar","institution_ids":["https://openalex.org/I4210144839"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.01498464,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":null,"first_page":"5541","last_page":"5552"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.5472999811172485,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.5472999811172485,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.19290000200271606,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.11509999632835388,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.6496999859809875},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6062999963760376},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5769000053405762},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.49709999561309814},{"id":"https://openalex.org/keywords/segmentation","display_name":"Segmentation","score":0.4187999963760376},{"id":"https://openalex.org/keywords/residual","display_name":"Residual","score":0.40400001406669617},{"id":"https://openalex.org/keywords/supervised-learning","display_name":"Supervised learning","score":0.38420000672340393},{"id":"https://openalex.org/keywords/biometrics","display_name":"Biometrics","score":0.37229999899864197},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.35740000009536743}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8166999816894531},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.6496999859809875},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6062999963760376},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5769000053405762},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.541700005531311},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.49709999561309814},{"id":"https://openalex.org/C89600930","wikidata":"https://www.wikidata.org/wiki/Q1423946","display_name":"Segmentation","level":2,"score":0.4187999963760376},{"id":"https://openalex.org/C155512373","wikidata":"https://www.wikidata.org/wiki/Q287450","display_name":"Residual","level":2,"score":0.40400001406669617},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3896999955177307},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.38420000672340393},{"id":"https://openalex.org/C184297639","wikidata":"https://www.wikidata.org/wiki/Q177765","display_name":"Biometrics","level":2,"score":0.37229999899864197},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.35740000009536743},{"id":"https://openalex.org/C171906077","wikidata":"https://www.wikidata.org/wiki/Q1360677","display_name":"Crime scene","level":2,"score":0.3458999991416931},{"id":"https://openalex.org/C2780732888","wikidata":"https://www.wikidata.org/wiki/Q2314618","display_name":"Forensic identification","level":2,"score":0.34060001373291016},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3393000066280365},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.32899999618530273},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.3287999927997589},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3188999891281128},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.29809999465942383},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2971999943256378},{"id":"https://openalex.org/C4438859","wikidata":"https://www.wikidata.org/wiki/Q186117","display_name":"Timeline","level":2,"score":0.2930000126361847},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.28130000829696655},{"id":"https://openalex.org/C517642484","wikidata":"https://www.wikidata.org/wiki/Q2388514","display_name":"Intelligence analysis","level":2,"score":0.2718000113964081},{"id":"https://openalex.org/C168406668","wikidata":"https://www.wikidata.org/wiki/Q178022","display_name":"Fingerprint recognition","level":3,"score":0.262800008058548},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.26080000400543213},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2597000002861023},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.25929999351501465},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2581000030040741}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/access.2026.3651297","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3651297","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/access.2026.3651297","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3651297","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.5395693182945251,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320334468","display_name":"Qatar National Library","ror":"https://ror.org/02jv93662"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W2799758613","https://openalex.org/W2895909303","https://openalex.org/W2955014922","https://openalex.org/W2977752193","https://openalex.org/W3036554922","https://openalex.org/W3158373632","https://openalex.org/W4225359190","https://openalex.org/W4281945976","https://openalex.org/W4389351690","https://openalex.org/W4393186175","https://openalex.org/W4393371739","https://openalex.org/W4399300323","https://openalex.org/W4400583162","https://openalex.org/W4401608845","https://openalex.org/W4402035331","https://openalex.org/W4402352585","https://openalex.org/W4402356832","https://openalex.org/W4403371487","https://openalex.org/W4404058778","https://openalex.org/W4407237697","https://openalex.org/W4408411105","https://openalex.org/W4409095121","https://openalex.org/W4410351913","https://openalex.org/W4410889209"],"related_works":[],"abstract_inverted_index":{"The":[0,58,139],"rapid":[1],"adoption":[2],"of":[3,5,55,135,148],"Internet":[4],"Things":[6],"(IoT)":[7],"devices":[8],"has":[9],"amplified":[10],"security":[11],"risks,":[12],"particularly":[13],"in":[14],"post-incident":[15,68],"scenarios":[16],"where":[17],"accurate":[18],"device":[19,62],"attribution":[20,88],"and":[21,35,64,87,96,105,113,132,151],"evidence":[22,144],"reconstruction":[23,112,147],"are":[24],"required.":[25],"Existing":[26],"intrusion":[27],"detection":[28,34,86,125],"solutions":[29],"mainly":[30],"focus":[31],"on":[32,117],"real-time":[33],"provide":[36],"limited":[37],"forensic":[38,53,110,143],"support":[39],"after":[40],"an":[41],"attack.":[42],"This":[43],"paper":[44],"proposes":[45],"a":[46,118],"phase-aware":[47],"behavioral":[48,73],"fingerprinting":[49],"framework":[50,140],"for":[51],"post-attack":[52,106,136,152],"analysis":[54],"IoT":[56,120],"devices.":[57],"approach":[59],"models":[60],"normal":[61],"behavior":[63],"compares":[65],"it":[66],"with":[67,89],"activity":[69],"to":[70,93,129],"identify":[71],"persistent":[72],"deviations":[74],"caused":[75],"by":[76],"compromise.":[77],"A":[78],"layered":[79],"learning":[80],"strategy":[81],"is":[82],"employed,":[83],"combining":[84],"supervised":[85],"unsupervised":[90],"anomaly":[91],"identification":[92,134],"capture":[94],"residual":[95,137],"previously":[97],"unseen":[98,130],"behaviors.":[99],"Temporal":[100],"segmentation":[101],"into":[102],"pre-attack,":[103],"attack,":[104],"phases":[107],"enables":[108,146],"reliable":[109],"timeline":[111],"realistic":[114],"evaluation.":[115],"Experiments":[116],"real-world":[119],"traffic":[121],"dataset":[122],"demonstrate":[123],"high":[124],"accuracy,":[126],"strong":[127],"generalization":[128],"devices,":[131],"effective":[133],"behavior.":[138,153],"produces":[141],"time-aligned":[142],"that":[145],"attack":[149],"progression":[150]},"counts_by_year":[],"updated_date":"2026-01-16T23:16:36.188383","created_date":"2026-01-08T00:00:00"}