Using JA4+ Fingerprints for Device Identification in Encrypted IoT Networks

1. Introduction

The rapid proliferation of Internet of Things (IoT) devices has significantly transformed modern networked environments, enabling automation, monitoring, and smart services across industrial, residential, healthcare, and critical infrastructure domains [1]. However, the increasing number and heterogeneity of connected devices have also introduced major challenges in network visibility, device management, and cybersecurity [2]. Identifying devices operating within IoT networks is becoming progressively more difficult due to the widespread adoption of encrypted communication protocols and the growing complexity of network ecosystems.

Traditional network traffic inspection techniques used to rely heavily on payload analysis and deep packet inspection (DPI) to identify applications, services, or devices. Nevertheless, the evolution of transport security mechanisms, particularly the adoption of TLS 1.3 and Encrypted Client Hello (ECH), has substantially reduced the visibility available to network monitoring systems [3,4]. As encryption becomes the default mechanism for protecting communications, conventional inspection approaches lose effectiveness because relevant application-layer information is no longer accessible without decryption.

In this context, passive network traffic fingerprinting has emerged as a promising alternative for encrypted traffic analysis. Rather than inspecting payload contents, fingerprinting techniques leverage observable characteristics of network protocols, such as TLS handshake parameters or TCP metadata, to derive behavioral signatures associated with devices or applications. One of the most widely adopted approaches is JA3 fingerprinting, which generates signatures from TLS Client Hello parameters [5]. More recently, JA4+ fingerprinting has extended this concept by incorporating additional transport-layer and protocol-level characteristics designed to improve consistency, interpretability, and resilience against fingerprint randomization [6,7].

The use of JA4+ fingerprints is particularly attractive in IoT environments. Many IoT devices generate relatively stable communication patterns due to constrained hardware, embedded firmware, and specialized functionality, together with scarce software updates. These characteristics make transport-layer fingerprints suitable candidates for passive device identification and behavioral monitoring without requiring payload decryption. Furthermore, passive fingerprinting approaches align well with privacy-preserving and low-overhead monitoring architectures, which are increasingly important in modern security frameworks.

Previous studies have explored the use of TLS fingerprinting and machine learning techniques for encrypted traffic analysis, malicious traffic detection, and IoT device classification [8,9,10]. However, most existing approaches focus either on exact fingerprint matching or on fingerprint enrichment using additional metadata such as the Server Name Indication (SNI). As ECH adoption increases, relying on domain-related metadata may become progressively less viable for long-term encrypted traffic analysis methodologies.

This work investigates the use of JA4+ fingerprints for IoT device identification in encrypted network environments without relying on SNI-based information. In particular, the study evaluates multiple JA4+ fingerprint combinations extracted from encrypted traffic traces derived from the CICIoT2023 dataset [11]. The proposed methodology compares complete fingerprint representations with decomposed protocol-level features in order to evaluate whether feature decomposition improves classification performance or primarily provides interpretability and feature-level analytical capabilities.

The experimental study was conducted using dictionary-based classification techniques and Random Forest (RF) models applied to JA4+, JA4S, JA4T, JA4TS, and JA4X fingerprints, extracted using the Zeek network monitoring framework [12] and custom scripts. The obtained results indicate that complete JA4+ fingerprint representations already provide strong discriminative capabilities for IoT device identification, while decomposed representations achieve comparable performance without consistently improving classification accuracy.

The main contributions of this paper are summarized as follows:

• Evaluation of JA4+ fingerprints for passive IoT device identification in encrypted network environments.
• Experimental evidence that protocol-level decomposition of JA4+ fingerprints does not provide consistent classification improvements over compact JA4+ representations for IoT device identification, while improving interpretability.
• Assessment of multiple JA4+ fingerprint combinations without relying on SNI-based metadata.
• Experimental validation using encrypted traffic traces derived from the CICIoT2023 dataset.
• Analysis of the interpretability and practical limitations of JA4+-based fingerprinting for scalable IoT security monitoring.

The remainder of this paper is organized as follows. Section 2 reviews related work on encrypted traffic analysis, IoT fingerprinting, and JA4+-based approaches. Section 3 provides background information on JA4+ fingerprinting and encrypted traffic characterization. Section 4 describes the experimental methodology, including dataset preparation, feature extraction, and machine learning methods. Section 5 presents the experimental results, comparative analysis, and study limitations. Section 6 discusses the implications and security considerations of the proposed approach. Finally, Section 7 concludes the paper and outlines future research directions.

2. Related Work

The analysis and classification of encrypted network traffic have become an increasingly relevant research topic due to the widespread adoption of TLS-based communication protocols in modern Internet and IoT environments. Traditional traffic inspection approaches based on payload analysis and DPI are progressively losing effectiveness because encryption mechanisms conceal most application-layer information from network monitoring systems. Consequently, passive fingerprinting and machine learning techniques have emerged as promising alternatives for encrypted traffic characterization and device identification.

One of the earliest and most influential approaches in TLS fingerprinting is JA3, which generates fingerprints from selected fields contained in the TLS Client Hello message [5]. JA3-based fingerprints have been widely adopted for malware detection, threat intelligence, and encrypted traffic analysis because they provide lightweight and passive identification capabilities without requiring payload decryption. However, JA3 also presents several limitations related to fingerprint instability, susceptibility to evasion techniques, and dependence on exact fingerprint matching.

To address some of these limitations, the JA4+ framework was introduced as an evolution of previous TLS fingerprinting methodologies [6,7]. JA4+ extends traditional TLS fingerprinting by incorporating additional protocol- and transport-layer metadata while improving fingerprint readability, consistency, and interpretability. The framework includes multiple complementary fingerprints associated with TLS, TCP, HTTP, SSH, and certificate-level information, including JA4, JA4S, JA4T, JA4TS, and JA4X, among others [13]. These fingerprints aim to provide more stable and semantically meaningful representations than previous hash-only approaches.

Several studies have explored the use of TLS fingerprinting and machine learning techniques for encrypted traffic analysis. Paracha et al. [8] analyzed TLS usage patterns in consumer IoT devices and demonstrated that encrypted traffic metadata still contains valuable information capable of revealing device-specific behaviors. Similarly, Siwakoti and Rawat [9] investigated the use of JA3 fingerprints combined with machine learning models for malicious traffic detection, showing that passive TLS fingerprints can support effective classification systems even in encrypted environments.

Recent research has also explored fingerprinting approaches specifically oriented toward IoT device identification and behavioral profiling. Llano-Miraval et al. [10] investigated the use of decomposed TLS handshake features for encrypted IoT traffic classification and analyzed defensive strategies against AI-driven traffic analysis. Their work demonstrated that protocol-level feature decomposition can support machine learning-based classification methodologies while improving interpretability of encrypted traffic representations. Other works have investigated machine learning-based approaches for IoT security enhancement using fingerprinting techniques and embedded device characteristics [14,15].

Recent works have also explored the practical use of JA4+ fingerprints for encrypted traffic analysis. For instance, Burgetová et al. [16] investigated the identification of network applications in encrypted TLS traffic by comparing several complementary approaches, including JA3/JA4 fingerprinting, SNI-based identification, and machine learning classifiers. Their study showed that the combination of JA4 and JA4S fingerprints provides better identification performance than the legacy JA3/JA3S approach, confirming the advantages of the newer fingerprinting methodology. Later, Fernández Terrasa et al. [17] explored the identification of encrypted mobile application traffic using fingerprint-based methodologies, emphasizing the applicability of passive traffic characterization techniques for encrypted communication analysis. Unlike these works, which focus on application identification and the comparison of multiple identification techniques, our study investigates the use of the complete JA4+ fingerprint family for IoT device identification and, in particular, analyzes whether decomposing JA4+ fingerprints into protocol-level attributes provides measurable benefits for machine-learning-based classification.

JA4+ fingerprints have also been successfully applied to cybersecurity tasks beyond device identification. Matoušek et al. [18] demonstrated the applicability of JA4+ fingerprints for malware detection, showing that protocol-level metadata can effectively distinguish malicious from benign communications without decrypting traffic. Similarly, Polo Peyres et al. [19] evaluated machine learning approaches for malware detection using statistical traffic features and fingerprinting information extracted from encrypted communications. Their work focuses on threat detection, whereas the present study investigates the use of JA4+ fingerprints for passive identification of IoT devices and evaluates the impact of decomposing JA4+ fingerprints into protocol-level features for machine learning-based classification.

In parallel, multiple datasets and benchmarking initiatives have been proposed to support research on IoT traffic analysis and intrusion detection. Among them, the CICIoT2023 dataset [11] has become a relevant benchmark for evaluating large-scale IoT security and encrypted traffic classification methodologies due to its diversity of devices, attack scenarios, and communication traces.

Despite the growing interest in JA4+ fingerprinting and encrypted traffic analysis, several challenges remain insufficiently explored. First, many existing approaches continue relying on exact fingerprint matching techniques or on metadata such as the SNI, whose long-term availability may be reduced by mechanisms such as ECH. Second, although feature decomposition approaches have been proposed in previous works, the practical impact of decomposed protocol-level representations on classification performance remains unclear.

In particular, it is still uncertain whether decomposed fingerprint representations provide substantial advantages over compact JA4+-based fingerprints for IoT device identification in encrypted environments. This paper addresses these questions by systematically evaluating multiple JA4+ fingerprint combinations and comparing complete fingerprint representations with decomposed protocol-level features using machine learning-based classification techniques.

3. Background on JA4+ Fingerprinting

Passive fingerprinting techniques aim to identify devices, applications, or communication patterns by analyzing observable network metadata without requiring payload inspection. In encrypted environments, where application-layer information becomes inaccessible due to the widespread adoption of TLS encryption, passive fingerprinting has emerged as an important mechanism for maintaining network visibility and supporting traffic characterization tasks.

One of the earliest and most influential approaches in TLS fingerprinting is JA3, which generates signatures from selected fields contained in the TLS Client Hello message [5]. JA3 fingerprints are constructed using ordered values such as TLS version, cipher suites, extensions, supported groups, and elliptic curve point formats. The resulting fingerprint is typically represented as an MD5 hash associated with a particular TLS client configuration.

Although JA3 gained widespread adoption due to its simplicity and effectiveness for malware detection and encrypted traffic analysis, several practical limitations have been identified. First, JA3 fingerprints are sensitive to protocol changes, extension ordering variations, software updates, and implementation differences. Second, exact fingerprint matching approaches may suffer from reduced robustness in heterogeneous environments. Finally, JA3 primarily focuses on TLS handshake metadata and does not incorporate additional transport-layer context.

To address some of these limitations, the JA4+ framework was introduced as an evolution of previous TLS fingerprinting methodologies [6,7]. Unlike JA3, JA4+ was designed to improve fingerprint consistency, readability, and interpretability while incorporating additional protocol- and transport-layer information. The framework defines multiple complementary fingerprint types associated with different protocol layers and communication stages.

The JA4+ ecosystem includes fingerprints associated with TLS, TCP, HTTP, SSH, and X.509 certificate information. Among them, JA4 focuses on TLS client fingerprinting, JA4S characterizes TLS server responses, JA4T and JA4TS extend fingerprinting to TCP-level communication patterns, and JA4X incorporates certificate-related information [13]. These fingerprints aim to provide semantically meaningful protocol representations suitable for passive encrypted traffic analysis.

Figure 1 illustrates the structure of a typical JA4 fingerprint and its decomposition into protocol-level components. Unlike traditional opaque hash-based representations, JA4+ fingerprints preserve part of the semantic structure of the underlying protocol metadata, enabling feature-level interpretation and analysis.

Table 1 summarizes the main differences between JA3 and JA4+ fingerprinting approaches. Compared with JA3, JA4+ incorporates additional metadata sources, improves interpretability, supports protocol-level feature decomposition, and includes more protocols apart from TLS.

The interpretability provided by JA4+ decomposition enables analysis of individual protocol-level characteristics used during encrypted communication. Such decomposition may facilitate feature-level inspection and machine learning-based analysis by exposing semantically meaningful protocol attributes instead of relying exclusively on exact fingerprint equality.

This capability is particularly relevant in IoT environments, where many devices exhibit relatively stable communication patterns determined by embedded firmware, constrained hardware resources, and specialized application behavior. Consequently, transport-layer metadata and TLS handshake characteristics can provide sufficiently distinctive signatures for passive device identification and monitoring purposes.

At the same time, evolving encryption standards continue reducing the amount of metadata exposed during encrypted communication. Mechanisms such as TLS 1.3 and ECH progressively conceal protocol information that was previously accessible during TLS negotiation [3,4]. In particular, ECH limits the visibility of metadata such as the SNI, which has traditionally been used in several encrypted traffic classification methodologies.

Under these conditions, passive fingerprinting techniques that rely exclusively on observable protocol and transport-layer characteristics become increasingly relevant for future encrypted traffic analysis systems. Consequently, understanding the discriminative capabilities and limitations of JA4+-based fingerprints without relying on SNI-related information represents an important research challenge.

In this work, JA4+, JA4S, JA4T, JA4TS, and JA4X fingerprints are analyzed both as complete identifiers and as decomposed protocol-level components in order to evaluate their suitability for machine learning-based IoT device identification. The study specifically investigates whether decomposed representations provide practical advantages over compact fingerprint-based approaches in encrypted environments where metadata visibility is progressively reduced.

4. Methodology

This section describes the experimental methodology used to evaluate the effectiveness of JA4+ fingerprints for passive IoT device identification in encrypted network environments. The proposed workflow includes dataset preparation, encrypted traffic processing, fingerprint extraction, feature representation generation, and machine learning-based classification.

4.1. Overview of the Experimental Pipeline

The experimental workflow was designed to evaluate multiple JA4+ fingerprint combinations under different representation strategies. In particular, the study compares complete fingerprint representations with decomposed protocol-level features in order to determine whether feature decomposition provides practical advantages for IoT device classification.

Figure 2 summarizes the overall processing pipeline adopted in this work.

The workflow begins with encrypted traffic traces extracted from the CICIoT2023 dataset [11]. Packet captures were processed using the Zeek network monitoring framework in order to extract JA4, JA4S, JA4X, JA4T, and JA4TS fingerprints together with associated TLS- and TCP-level metadata.

The extracted information was subsequently transformed into different feature representations suitable for classification analysis. Two primary representation strategies were considered during the experiments:

• Complete fingerprint representations based on exact JA4+ identifiers.
• Decomposed protocol-level representations derived from the semantic components of JA4+ fingerprints.

The resulting feature sets were evaluated using both dictionary-based classification techniques and RF models.

4.2. Dataset Description

The experiments conducted in this work were based on the CICIoT2023 dataset [11], which provides large-scale network traffic captures generated from heterogeneous IoT environments under both benign and malicious conditions. The dataset includes multiple IoT device categories, communication protocols, and attack scenarios, making it suitable for evaluating encrypted traffic analysis methodologies.

The selected capture corresponds to benign IoT traffic from the CICIoT2023 dataset. The original PCAP file, BenignTraffic.pcap, has an approximate size of 1.90 GB and contains traffic generated by 55 IoT devices. Device labels were assigned using a MAC-to-device mapping file created for this study, which associates observed MAC addresses with IoT device names and broader device categories.

For this study, only traffic traces relevant to encrypted communication analysis were considered. Packet capture (PCAP) files containing TLS-based communication flows were processed in order to extract JA4+-related fingerprint information and associated metadata. The use of encrypted traffic traces enables evaluation of passive identification methodologies under realistic visibility constraints where payload inspection is not available.

Since not all fingerprint families are present in every connection, the number and composition of the samples available for classification may differ across fingerprint combinations. Consequently, comparisons between configurations should be interpreted as empirical observations rather than as strictly controlled evaluations of the incremental contribution of each fingerprint family.

Table 2 summarizes the main characteristics of the dataset and the extracted fingerprint representations used during the experiments.

As is common in IoT traffic datasets, the number of connections generated by each device was highly unbalanced. To mitigate the impact of class imbalance during model training and evaluation, classes with insufficient samples were excluded, while highly dominant classes were constrained through dataset filtering. The selected thresholds were manually adjusted according to the fingerprint distribution observed in the CICIoT2023 benign traffic capture, ensuring that all retained device classes contained sufficient samples for both training and testing.

4.3. Fingerprint Extraction and Preprocessing

JA4+ fingerprints were extracted from the network traces using Zeek [12]. Zeek was configured to process PCAP files and generate structured logs containing TLS- and TCP-related fingerprint metadata. Additional preprocessing scripts implemented in Python were used to consolidate extracted information and prepare feature representations for classification analysis.

JA4X fingerprints were generated only for connections in which X.509 certificate information was observable in the processed traces. No attempt was made to infer certificate-derived fingerprints for connections whose certificate messages were encrypted or otherwise unavailable. The resulting JA4X-based experiments therefore used a subset of the connections considered in the JA4-, JA4S-, and TCP-based configurations.

Two parallel feature-generation pipelines were therefore created. The first preserved each JA4+ fingerprint as a complete categorical identifier, whereas the second decomposed fingerprints into their constituent protocol-level attributes. This design enabled a direct comparison between compact fingerprint representations and feature-level representations while keeping the remaining stages of the classification workflow unchanged.

The preprocessing stage included cleaning incomplete records, normalizing categorical values, handling missing fields, and organizing extracted fingerprints according to device labels available in the dataset. Fingerprints were then transformed into two alternative representations:

• Complete fingerprint strings.
• Decomposed protocol-level components.

The decomposition process enabled analysis of individual protocol-level characteristics such as TLS versions, cipher suite counts, extension counts, ALPN identifiers, transport protocols, and additional metadata components extracted from JA4+ fingerprints.

Table 3 summarizes the evaluated fingerprint representations considered during the experiments. Moreover, Table 4 summarizes the protocol-level characteristics extracted from each JA4+ fingerprint family and the number of features contributed by each one for the decomposed fingerprints. Together, these fingerprint families provide a structured representation of observable TLS, TCP, and X.509 certificate metadata that forms the basis for the classification experiments discussed later.

To complete the characterization of the dataset, Figure 3 summarizes the distribution of extracted JA4+JA4S fingerprints across the analyzed IoT devices, including both the total number of observed fingerprints and the number of distinct fingerprints per device. This characterization provides an overview of the variability present in the dataset prior to the classification experiments.

4.4. Classification Methodology

Two classification approaches were evaluated during the experiments: dictionary-based classification and Random Forest models.

The dictionary-based methodology relied on exact fingerprint matching between training and testing instances. This approach evaluates the discriminative capability of compact fingerprint representations under direct comparison conditions.

RF classifiers were selected as the primary machine learning methodology due to their robustness, interpretability, and suitability for heterogeneous categorical feature spaces. In addition, RF models provide feature importance estimations that facilitate analysis of the discriminative capabilities associated with individual fingerprint components.

After class filtering, the dataset was partitioned independently for each device category in order to preserve the presence of every class in both training and testing subsets. For each retained device, 80% of the available samples were assigned to the training set and 20% to the testing set. This procedure ensured that all evaluated device categories were represented during both model training and evaluation.

The evaluated hyperparameters included the number of estimators, maximum tree depth, minimum samples per split, and minimum samples per leaf. The final configuration was selected according to Macro F1-score performance using a grid search algorithm to find the best suited hyperparameters with a cross validation of 5 subsets in the training dataset.

Categorical fingerprint features were transformed into binary indicator variables using one-hot encoding prior to model training. The encoder was fitted using the training data and subsequently applied to the testing data. All experiments were executed using a fixed random seed (42) to ensure reproducibility of the obtained results.

The experiments evaluated multiple fingerprint combinations, including JA4, JA4S, JA4T, JA4TS, and JA4X representations, both independently and in combined configurations. In addition, decomposed protocol-level features were evaluated in order to compare their effectiveness against compact fingerprint representations.

4.5. Evaluation Metrics

Several evaluation metrics were considered to assess the effectiveness of JA4+-based IoT device identification. Accuracy was used as a general indicator of classification performance, whereas precision, recall, and Macro F1-score provided additional insight into class-level behavior and model robustness.

In addition, Top-1, Top-3, and Top-5 accuracy metrics were evaluated in order to analyze the ranking capabilities of the classification methodologies. These metrics are particularly relevant in IoT identification scenarios where multiple candidate device categories may exhibit partially overlapping fingerprint characteristics.

Top-k metrics were included because several IoT device categories exhibit partially overlapping communication behaviors and similar protocol stacks. Under this evaluation strategy, a prediction is considered correct if the true device category appears within the k highest-ranked predictions generated by the classifier.

These metrics are particularly useful in passive IoT identification scenarios, where identifying a small set of likely candidate devices may already provide valuable operational information for network monitoring and security analysis.

Table 5 summarizes the evaluation metrics considered during the experiments.

Feature importance analysis was additionally performed using RF classifiers in order to identify the most discriminative protocol-level fingerprint characteristics. This analysis supports evaluation of the practical utility and interpretability of decomposed JA4+ representations.

4.6. Top-Feature Evaluation

In addition to the baseline classification experiments, an auxiliary analysis was conducted to evaluate the contribution of individual fingerprint components to the overall classification performance. This analysis aimed to determine whether a reduced subset of highly informative features could achieve results comparable to those obtained using the complete feature set. Feature rankings and reduced feature subsets were derived exclusively from the training data. The testing subset was not used during feature ranking, hyperparameter selection, or subset definition.

Feature importance scores were computed using the intrinsic ranking mechanism provided by the RF classifier. The resulting importance values were then aggregated according to their original JA4+ fingerprint components in order to identify the protocol-level attributes contributing most strongly to device classification.

Based on these rankings, additional classification models were trained using progressively smaller subsets of features. Multiple configurations were evaluated, including models restricted to the most important attributes identified during the feature importance analysis. The objective was to assess the extent to which classification performance could be preserved while reducing feature-space dimensionality.

5. Results

This section presents the experimental results obtained from the evaluation of JA4+ fingerprints for passive IoT device identification in encrypted network environments. The analysis compares compact fingerprint representations with decomposed protocol-level features using both dictionary-based classification and RF models. First, the overall classification performance achieved by the different fingerprint combinations and representation strategies is analyzed. The classification behavior is then examined through confusion matrix analysis, followed by an evaluation of feature importance to identify the protocol-level attributes contributing most strongly to device discrimination. An additional top-feature analysis investigates the impact of feature selection on classification performance. Finally, the main limitations of the experimental evaluation are outlined to provide the appropriate context for interpreting the reported results.

5.1. Classification Performance

The first stage of the evaluation analyzed the overall classification performance achieved using the different JA4+ fingerprint combinations and representation strategies. The experiments demonstrated that JA4+-based fingerprints provide strong discriminative capabilities for IoT device identification even when relying exclusively on observable encrypted traffic metadata.

Table 6 summarizes the main classification results obtained during the experiments. The full evaluated fingerprint combination (JA4+*) achieved the highest measured Macro F1-score and Top-1 accuracy under all three classification strategies. For the remaining fingerprint combinations, compact and decomposed Random Forest representations produced broadly comparable results, without a consistent advantage for either representation. These findings suggest that decomposition does not systematically improve predictive performance, although it enables feature-level interpretation.

Although the full fingerprint combination (JA4+*) achieved the highest performance, this configuration was evaluated only on connections for which all constituent fingerprints were available. Since the evaluated configurations may rely on partially different subsets of traffic, this result should not be interpreted as direct evidence that adding every fingerprint family necessarily improves classification performance.

From a predictive-performance perspective, fingerprint decomposition did not provide a consistent advantage over compact representations. Compact and decomposed configurations produced broadly comparable results, with only small and non-systematic differences across the evaluated combinations. Consequently, although decomposition does not consistently improve predictive performance, its contribution to feature-level interpretability is further explored in SubSection 5.3.

Finally, although computational performance was not quantitatively evaluated in this study, the dictionary-based approach achieved classification results comparable to those of the RF models for several fingerprint combinations while relying only on exact fingerprint matching. This suggests that dictionary-based classification may represent an attractive alternative for real-time monitoring environments, where its lightweight lookup-based operation could offer lower computational overhead than machine-learning-based inference, while achieving comparable classification performance for several evaluated fingerprint combinations.

5.2. Confusion Matrix Analysis

To further evaluate classification behavior, confusion matrix analysis was performed in order to identify patterns of correct and incorrect predictions across device categories.

Figure 4 presents the confusion matrix obtained for the RF classifier using the decomposed JA4 representation.

The confusion matrix analysis showed that most IoT device categories could be accurately distinguished using JA4+-based features. Nevertheless, certain device classes exhibited partial overlap due to similarities in protocol implementations, shared communication libraries, or comparable TLS configurations.

Misclassification patterns were more frequently observed among devices sharing common firmware ecosystems or communication stacks. These results suggest that although JA4+ fingerprints provide strong discriminative capabilities, some limitations remain when devices rely on highly similar transport- and application-layer behaviors.

5.3. Feature Importance Analysis

Feature importance analysis was subsequently performed with the training dataset to identify the protocol-level attributes contributing most strongly to classification performance. Figure 5 presents the relative importance of the twenty most relevant features extracted during the experiments for the whole set of signatures.

The analysis revealed that several JA4+ components provide particularly strong discriminative capabilities. The most relevant features were primarily associated with TLS negotiation behavior, extension-related metadata, ALPN identifiers, and transport-layer characteristics. These results indicate that a relatively small subset of protocol-level attributes concentrates most of the information required for effective device differentiation.

Interestingly, several JA4X certificate-derived features also appear among the most informative attributes. In particular, the issuer, subject, and certificate extension hashes provide substantial discriminative power, indicating that X.509 certificate metadata contributes to distinguishing IoT devices when such information is available.

At the same time, the results indicate that many decomposed protocol-level components individually provide limited additional discriminative value when compared with compact fingerprint representations. This observation is consistent with the classification results presented in Table 6.

5.4. Top-Feature Analysis

To further investigate the discriminative information encoded within JA4+ fingerprints, an additional set of experiments was conducted using reduced feature subsets derived from the feature importance rankings obtained from the RF classifier.

Starting from the complete decomposed feature set, progressively smaller subsets containing only the most relevant features were selected and used to train new classification models. The objective was to evaluate the effect of reducing the feature-space dimensionality on classification performance.

Table 7 summarizes the performance obtained using different numbers of selected features. The effect of feature reduction varied across fingerprint combinations. The full evaluated combination retained the same performance using 15 of the 33 available features, whereas other configurations exhibited different degrees of degradation, particularly in Top-1 accuracy. These findings indicate that reduced feature subsets may preserve competitive performance in some configurations, but the effect is not consistent across all evaluated combinations.

These findings suggest that only a limited number of JA4+ components concentrate most of the discriminative information required for IoT device identification. Consequently, feature selection may represent a viable strategy for reducing input dimensionality while maintaining competitive classification performance.

5.5. Limitations

Several limitations associated with the conducted experiments should be considered when interpreting the obtained results.

First, the evaluation was conducted using traffic traces derived from the CICIoT2023 dataset and a RF classifier. Although this experimental design enables a controlled comparison between compact and decomposed fingerprint representations, the results may not necessarily generalize to other IoT datasets, traffic conditions, or machine learning algorithms. Therefore, further validation using additional datasets and alternative classification models would strengthen the generality of the conclusions. Additionally, since different JA4+ components are not necessarily available for every network connection, the evaluated fingerprint configurations may rely on partially different subsets of traffic. Therefore, comparisons between configurations should be interpreted as empirical observations rather than strictly controlled incremental evaluations.

Second, the effectiveness of fingerprint-based identification approaches depends on the stability of observable protocol characteristics. Firmware updates, protocol modifications, operating system changes, and implementation-specific behaviors may alter fingerprint representations over time and affect classification consistency. Furthermore, fingerprint collisions may occur among devices sharing similar firmware ecosystems, operating systems, or communication libraries, as partially observed during the confusion matrix analysis.

Third, the study focused exclusively on passive encrypted traffic analysis without incorporating payload inspection or active probing techniques. While this design choice aligns with privacy-preserving monitoring objectives, it may also limit the amount of information available for device differentiation in highly homogeneous communication environments. In addition, adversarial manipulation represents an important challenge, since attackers may attempt to imitate legitimate protocol behaviors in order to evade fingerprint-based monitoring systems.

Finally, evolving encryption mechanisms such as TLS 1.3 and ECH continue reducing the amount of metadata available for passive traffic analysis. Although the evaluated JA4+ fingerprints rely primarily on observable transport- and protocol-layer information, future protocol developments may further constrain passive fingerprinting capabilities.

A particular limitation concerns JA4X, which relies on X.509 certificate information. In TLS 1.3, the Certificate message is transmitted after handshake encryption has been established, preventing a purely passive observer without access to session secrets from directly extracting JA4X. Certificate-derived fingerprints may still be available for TLS 1.2 or earlier sessions, from decrypted TLS 1.3 traffic, or when certificate information is obtained at an endpoint or through another trusted source. Therefore, the contribution of JA4X reported in this study should be interpreted in the context of the TLS-version distribution, certificate visibility, and monitoring architecture of the analyzed CICIoT2023 traffic.

Despite these limitations, the results demonstrate that JA4+-based fingerprints remain a viable and effective approach for passive IoT device identification under modern encrypted traffic conditions.

6. Discussion

The experimental results obtained in this work demonstrate that JA4+-based fingerprinting provides an effective mechanism for passive IoT device identification in encrypted network environments. The evaluated fingerprint combinations achieved strong classification performance while relying exclusively on observable protocol- and transport-layer metadata, without requiring payload inspection or SNI-based information.

One of the main objectives of this study was to evaluate whether decomposed protocol-level fingerprint representations provide practical advantages over compact JA4+ fingerprints for encrypted IoT traffic classification. The results indicate that both representation strategies achieve broadly comparable predictive performance. Rather than improving classification accuracy, the main value of decomposition lies in exposing the protocol-level attributes that drive device discrimination and enabling a more interpretable analysis of encrypted traffic.

Therefore, compact representations may be preferable when feature-level interpretation is not required. Nevertheless, decomposition remains valuable from an analytical perspective. By exposing individual protocol-level attributes, it improves interpretability, facilitates feature importance analysis, and enables a better understanding of which observable metadata elements contribute most strongly to device identification.

Another important implication of these findings concerns the evolution of encrypted communication protocols. Mechanisms such as TLS 1.3 and ECH continue reducing the amount of metadata exposed during encrypted communications [3,4]. For this reason, the experiments conducted in this work intentionally avoided relying on SNI-related information as a primary classification feature. Additionally, although several JA4X certificate-derived attributes contributed to device classification in the analyzed data, their operational availability depends on the TLS version and monitoring architecture. Consequently, the measured contribution of JA4X should be interpreted in the context of the analyzed traffic and extraction environment, as discussed above in the study limitations. In any case, the obtained results demonstrate that meaningful IoT device identification remains feasible using transport- and protocol-layer metadata that remain observable in the analyzed traffic traces. Thus, JA4+-based fingerprinting represents a practical approach for maintaining network visibility as encrypted protocols continue evolving.

From an operational perspective, the evaluated methodology presents several advantages for scalable IoT monitoring environments. Most of the evaluated JA4+ fingerprint families can be extracted passively without payload decryption and can be integrated into monitoring infrastructures using tools such as Zeek. Certificate-derived fingerprints constitute an exception when certificate messages are encrypted and no session keys are available. These characteristics make it suitable for asset inventory, continuous monitoring, anomaly detection, and Zero Trust architectures without compromising the confidentiality of application payloads.

However, the same characteristics that make passive fingerprinting attractive for network defense also raise important privacy concerns. Although JA4+ fingerprints do not expose application payloads or user data directly, they may still reveal the types of IoT devices operating within a monitored network. As a result, any entity capable of observing encrypted traffic—including Internet service providers, enterprise network administrators, or other monitoring entities—could potentially infer the composition of a user’s IoT ecosystem solely from protocol- and transport-layer metadata. This capability has a dual nature: it enables legitimate security and management applications, but it may also facilitate user profiling, reconnaissance activities, or targeted attacks against vulnerable device models. These observations highlight that improving confidentiality at the application layer does not necessarily eliminate information leakage through observable protocol metadata. In particular, ECH does not necessarily eliminate the possibility of fingerprint-based device inference based on other observable metadata. Future protocol evolution should therefore seek an appropriate balance between preserving operational visibility for network defense and minimizing unintended metadata leakage.

Overall, the results obtained in this work suggest that future research on JA4+-based IoT identification should focus less on increasingly complex feature engineering strategies and more on improving robustness against protocol evolution, fingerprint variability, and adversarial manipulation. In this context, the results indicate that compact JA4+ fingerprints already provide a practical balance between predictive performance, scalability, and deployment simplicity, while decomposed representations remain particularly valuable when interpretability and feature-level analysis are required.

7. Conclusions

This paper investigated the use of JA4+-based fingerprints for passive IoT device identification in encrypted network environments, where the progressive adoption of TLS 1.3, ECH, and other privacy-enhancing mechanisms continues reducing the availability of observable application-layer metadata.

The proposed methodology evaluated multiple JA4+ fingerprint combinations extracted from encrypted traffic traces derived from the CICIoT2023 dataset using both dictionary-based classifiers and Random Forest models. The results demonstrate that JA4+-based fingerprints provide strong discriminative capabilities for encrypted IoT device identification without relying on payload inspection or SNI-related information. Among the evaluated configurations, the complete JA4+* fingerprint combination achieved the highest performance, reaching a Macro F1-score of 0.8333 and a Top-1 accuracy of 0.9091, although this result should be interpreted within the availability constraints of complete fingerprint observations.

The experiments also showed that decomposed protocol-level representations did not consistently outperform compact fingerprints. Instead, their main contribution lies in improving feature-level interpretability by exposing the influence of individual protocol attributes, thereby facilitating the analysis of encrypted traffic characteristics and supporting future studies on protocol evolution and metadata visibility.

Future research should evaluate the robustness of JA4+-based fingerprinting under protocol evolution, firmware updates, implementation variability, adversarial manipulation, and increasingly restrictive encrypted communication standards. Extending the evaluation to additional IoT datasets and alternative machine learning models will also help assess the generality of the proposed approach.

Overall, the results indicate that JA4+-based fingerprinting constitutes a practical and effective solution for passive IoT device identification using only observable transport- and protocol-layer metadata. As encrypted communications continue limiting network visibility, these techniques may play an increasingly important role in IoT monitoring, anomaly detection, and security enforcement.