Passive Device Fingerprinting for OT Networks Using Byte Histograms

Device fingerprinting is a promising approach for securing Operational Technology (OT) networks by modeling the communication patterns of each device and using them to classify future network activity. This work proposes three byte-based fingerprinting strategies: byte histograms, n-grams, and machine learning models. Operating directly on raw packet bytes, these methods provide granular, protocol-agnostic fingerprints that avoid reliance on deep packet inspection or domain-specific feature engineering. The three strategies balance complementary strengths: byte histograms excel in modeling device-specific behavior, n-grams capture structural dependencies across consecutive bytes, and machine learning models prove most effective for generalizing to different network architectures. Experimental evaluation across two OT network testbeds demonstrates the robust classification performance for three device identification tasks: device-specific, unknown device, and cross-architecture testing. Results show that byte histograms and machine learning techniques achieve highest accuracy depending on the classification scenario, highlighting the practicality and adaptability of byte-level approaches for real-world OT device identification.