Abstract:With the continuous development of network devices, there are increasingly types and quantities of network devices. Accurate identification of device types helps proactively protect potentially vulnerable devices exposed on the Internet. Among the network device identification methods, the TCP/IP stack active detection method is an important kind since it does not require many open ports of target devices. However, its performance is limited by the rule/fingerprint database quality. Maintaining such a database requires a lot of expert effort, making the method difficult to scale up. To solve the scalability problem, our insight in this paper is to use machine learning methods to generate network device classifiers without needing expert effort. However, generating labeled datasets, extracting features, and selecting features without expert effort is non-trivial. We propose IntelliNDI, an intelligent and active network device identification method. IntelliNDI collects network device type information from multiple cyberspace search engines and filter out the network devices with different types on different search engines. We regard the approximately consistent network device types as the ground truth network device types. As for feature extraction, we use the same attributes employed in the well-known Nmap protocol stack detection to avoid the requirements for constructing features. Finally, we select features with basic ML methods. We implement IntelliNDI for several kinds of typical network devices. The trained classifiers in our experiments can achieve 90 percent accuracy.

Identification Of Visible Industrial Control Devices At Internet Scale

Automatic Protocol Reverse Engineering for Industrial Control Systems with Dynamic Taint Analysis

DIFORMER: an Attention-Based IoT Device Identification Method

Active Profiling Of Physical Devices At Internet Scale

A Survey of Industrial Control System Devices on the Internet

A Reflection-Based Channel Fingerprint to Locate Physically Intrusive Devices in ICS

Networked Industrial Control Device Asset Identification Method Based on Improved Decision Tree

From Exposed to Exploited: Drawing the Picture of Industrial Control Systems Security Status in the Internet Age.

DevPF: Device identification through passive fingerprints in IoT

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

Inferring Hidden IoT Devices and User Interactions Via Spatial-Temporal Traffic Fingerprinting

Intelligent Network Device Identification based on Active TCP/IP Stack Probing

Uncovering Vulnerable Industrial Control Systems from the Internet Core

A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild

ICScope: Detecting and Measuring Vulnerable ICS Devices Exposed on the Internet.

A Real-time Intrusion Detection Method for Industrial Control Network Based on Heterogeneous Feature Extractor

Channel-State-Based Fingerprinting Against Physical Access Attack in Industrial Field Bus Network

Research and Evaluation of Intelligent Threat Detection Under Industrial Internet

Type classification and identification of IoT devices by using traffic characteristics

Detecting IoT Devices and How They Put Large Heterogeneous Networks at Security Risk

Research on machine learning-based device fingerprint recognition technology for power internet of things