Detecting and Mitigating Behavioral Inference from Smart Home IoT Traffic Metadata

Abstract

The use of smart home devices in the past years, has grown on the day-to-day basis of a household. These IoT devices encrypt their cloud communications, but metadata like timing, frequency and protocol leak on the network with occupant routines. The purpose of this project is to demonstrate this privacy gap using a real residential network with five commercial IoT devices (iHome smart plugs, WiZ smart bulbs, and a TP-Link KL 125 plug) and then fortify the vulnerability, using a Raspberry Pi Zero 2 deployed as an in-network privacy shield referred to as “SecurePlug”. Forty-eight hours of pre-deployment traffic revealed that iHome plugs broadcast UDP heartbeats at an almost constant 1.7 seconds interval, and that WiZ bulbs transmit mDNS announcement bursts containing device fingerprints in plaintext during every state change. A Python inference pipeline extracted 28 behavioral events from this traffic and reconstructed the occupant’s daily routine (wake up, departure, arrival, and sleep) with 75% confidence. The real threat is metadata, not payload content. SecurePlug counters this with three interception layers: random jitter on iHome heartbeats (raising timing variance by 2,500x), jitter on WiZ UDP heartbeats, and full suppression of WiZ mDNS bursts. After 55 hours of shield operation, departure was undetectable on all four captured days, behavioral events dropped 64%, and inference confidence fell from 75% to 62%, insufficient to reconstruct a complete daily profile.