Adaptive Traffic Camouflage: Causal and Resource-Aware Defense Against IoT Fingerprinting

Encrypted IoT traffic can still reveal device identity through packet sizes, timing, direction, and packetization. This paper introduces a causal, resource-aware traffic camouflage controller that assesses leakage from a preceding traffic window and selects a budget-feasible transformation for the next window. It considers padding, packet splitting, timing, composite transformations, and leaving traffic unchanged when appropriate. Experiments on CIC-IoT-2022, IoT Sentinel, and UNSW evaluate clean-trained, defense-aware, and incremental-exposure fingerprinting attacks. The Balanced profile reduces mean attacker Macro-F1 by 13.2-23.3% relative to clean traffic with 4.88-7.47% average bandwidth overhead and at most 0.64 ms added latency. Protection varies across datasets and attacker adaptation regimes.