IoTTracker: An Enhanced Engine for Discovering Internet-of-Thing Devices

Effectively identifying IoT devices in cyberspace is significant for grasping the security posture of cyberspace. However, there are still some IoT devices without vendor or product keywords in response data that cannot be identified by existing device identification engines. In this paper, we propose a new engine (IoT Tracker)for identifying IoT devices by leveraging the highest similarity of response data between IoT devices of the same vendor or product. Based on the protocol features, IoT Tracker divides application-layer protocols into semistructured data protocols and unstructured data protocols. For each category, IoT Tracker extracts structure structure, style structure or simhash feature. Then, IoTTracker utilizes features extracted from the response data to identify IoT devices. We implement a prototype of our proposed engine and evaluate its effectiveness through real-world experiments. The experimental results show that IoTTracker yield very high accuracy with 95.54 % precision and 93.08 % recall at vendor-level. Compared with existing methods, IoT Tracker adds 40.76% of identifiable devices after de-duplicating the identified dataset.