Analyzing Zigbee Traffic: Datasets, Classification and Storage Trade-offs

TL;DR

This work addresses the lack of public Zigbee traffic datasets and topology-sensitive generalization in IoT forensics by introducing ZIOTP2025, a multi-topology Zigbee traffic dataset from 21 devices. Using time-windowed statistical features and XGBoost, the authors demonstrate high intra-topology accuracy for device-type classification ($F1$ ~ $0.95$–$0.97$) and for identifying individual devices ($F1$ ~ $0.93$), while cross-topology generalization degrades, especially for fine-grained identification. The study further analyzes storage-accuracy trade-offs, showing that lossy feature quantization can reduce storage by roughly $4$--$5\times$ without significantly sacrificing classification performance. These findings underscore the need for topology-aware analysis and storage-efficient representations in scalable IoT forensic systems, and point to future work on expanding topologies and adaptive compression strategies. $

Abstract

Zigbee is widely used in smart home environments due to its low power consumption and support for mesh networking, making it a relevant target for traffic-based IoT forensic analysis. However, existing studies often rely on limited datasets and fixed network configurations. In this paper, we analyze Zigbee network traffic from three complementary perspectives: data collection, traffic classification, and storage efficiency. We introduce ZIOTP2025, a publicly available dataset of Zigbee traffic collected from commercial smart home devices deployed under multiple network configurations and capturing realistic interaction scenarios. Using this dataset, we study two traffic classification tasks: device type classification and individual device identification, and evaluate their robustness under both intra-configuration and cross-configuration settings. Our results show that while high classification accuracy can be achieved under controlled conditions, performance degrades significantly when models are evaluated across different network configurations, particularly for fine-grained identification tasks. Finally, we investigate the trade-off between traffic storage requirements and classification accuracy. We show that lossy compression of traffic features through quantization can reduce storage requirements by approximately 4-5x compared to lossless storage of raw packet traces, while preserving near-lossless classification performance. Overall, our results highlight the need for topology-aware Zigbee traffic analysis and storage-efficient feature compression to enable robust and scalable IoT forensic systems.

Figures (7)

• Figure 1: Network configuration of the smart home and acquisition pipeline used to capture Zigbee and IP traffic from commercial IoT devices. The smart home is managed by a central gateway acting as PAN coordinator, while a dedicated sniffer and a monitoring host capture Zigbee and IP network traces within an isolated network.
• Figure 2: Device disposition during the acquisition campaign for the two considered topologies. Devices are positioned according to their physical deployment and labeled as reported in Table \ref{['tab:dataset']}. The outer line style identifies the device role (PANC, FFD, or RFD). Color coding indicates the logical communication path toward the PANC: white denotes devices directly associated with the PANC, while colored devices communicate with the PANC via an intermediate FFD acting as a router.
• Figure 3: Weighted and Macro F1-Score across different window sizes for: (a) device type classification and (b) individual device identification classification task.
• Figure 4: Normalized Confusion matrix for device type classification on a 5-second window in topology B.
• Figure 5: Normalized Confusion matrix for individual device identification on a 5-second window in topology B.