Detecting consumer IoT devices through the lens of an ISP

Abstract

Internet of Things (IoT) devices are becoming increasingly popular and offer a wide range of services and functionality to their users. However, there are significant privacy and security risks associated with these devices. IoT devices can infringe users' privacy by ex-filtrating their private information to third parties, often without their knowledge.In this work we investigate the possibility to identify IoT devices and their location in an Internet Service Provider's network. By analyzing data from a large Internet Service Provider (ISP), we show that it is possible to recognize specific IoT devices, their vendors, and sometimes even their specific model, and to infer their location in the network. This is possible even with sparsely sampled flow data that are often the only datasets readily available at an ISP. We evaluate our proposed methodology [1] to infer IoT devices at subscriber lines of a large ISP. Given ground truth information on IoT devices location and models, we were able to detect more than 77% of the studied IoT devices from sampled flow data in the wild.

Simulating and Estimating the Effectiveness of Security Notification by ISP to Malware-Infected Users

“…Work [13] sends security notifications and evaluates the effectiveness by questionnaire. Most of the related works focus on the technologies to monitor and analyze malware activities [16], [18], [19], [20]. Works [9], [10], [12], [17] send security notifications via ISPs.…”