Acquisitional Rule-based Engine for Discovering Internet-of-Things Devices
summary
ARE automatically generates discovery rules without training data by matching application-layer responses from devices to crawled product pages, defining a transaction mapping between a unique response and a product description and using an association algorithm to produce (type, vendor, product) rules. It generates ~100k rules in a week, achieves >90% annotation coverage versus ~30% for MAC-based labels, reports ~95% precision on test sets, runs cheaply, discovers exposed and vulnerable devices at Internet scale and flags ~50 compromised IoT devices per day from honeypots.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:28Outline
- 3:37Device Annotation
- 5:07Key Observation
- 6:40Technical Challenges
- 7:14Rule Miner
- 8:14Transaction
- 8:47Device Entity Recognition (DER)
- 11:06Rule Generation
- 12:30Design and implementation
- 13:23Real-world Evaluation
- 16:20Internet-wide Device Measurement
- 17:21Compromised Device Detection
- 18:40Vulnerable Device Analysis
- 19:34Conclusion
related talks
20mMastering global IoT compliance: How AI simplifies RED and the Cyber Resilience Act
51mCreate IoT Automation Using SmartThings New Rules API
41mTechniques for Automatic Device Identification and Network Assignment
25mModel-Driven IoT App Stores: Deploying Customizable Software Products to Heterogeneous Devices
51mOT Reverse Engineering - What Can Be Automated?
45mSweeping Up...
27mSpecification Mining for Intrusion Detection in Networked Control Systems
32mBuilding Intelligent Automatons with Semantic Reasoning