DeviceRadar: Online IoT Device Fingerprinting in ISPs using Programmable Switches

arXiv:2404.12738v1 Announce Type: cross
Abstract: Device fingerprinting can be used by Internet Service Providers (ISPs) to identify vulnerable IoT devices for early prevention of threats. However, due to the wide deployment of middleboxes in ISP networks, some important data, e.g., 5-tuples and flow statistics, are often obscured, rendering many existing approaches invalid. It is further challenged by the high-speed traffic of hundreds of terabytes per day in ISP networks. This paper proposes DeviceRadar, an online IoT device fingerprinting framework that …

arxiv can cs.cr cs.ni data deployment device devices fingerprinting flow identify important internet internet service iot iot device iot devices isp isp networks isps middleboxes networks prevention service service providers statistics switches threats vulnerable