# IoT Sentinel: Automated Device-Type Identification for Security Enforcement in IoT

arXiv: https://arxiv.org/abs/1611.04880 · HTML: https://mlsanity.com/paper/1611.04880/

## Key facts

- Cited by 30 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Nov 2016.

## Built on by (most cited first, 30 of 30)

- [Machine Learning for the Detection and Identification of Internet of Things (IoT) Devices: A Survey](https://mlsanity.com/paper/2101.10181/) (2021)
- [Revisiting IoT Device Identification](https://mlsanity.com/paper/2107.07818/) (2021)
- [Exploring Edge TPU for Network Intrusion Detection in IoT](https://mlsanity.com/paper/2103.16295/) (2021)
- [IoTDevID: A Behavior-Based Device Identification Method for the IoT](https://mlsanity.com/paper/2102.08866/) (2021)
- [Mapping the Landscape of Generative AI in Network Monitoring and Management](https://mlsanity.com/paper/2502.08576/) (2025)
- [ZEST: Attention-based Zero-Shot Learning for Unseen IoT Device Classification](https://mlsanity.com/paper/2310.08036/) (2023)
- [Enhancing IoT Security via Automatic Network Traffic Analysis: The Transition from Machine Learning to Deep Learning](https://mlsanity.com/paper/2312.00034/) (2023)
- [IoT Device Identification Based on Network Communication Analysis Using Deep Learning](https://mlsanity.com/paper/2303.12800/) (2023)
- [A Novel IoT Trust Model Leveraging Fully Distributed Behavioral Fingerprinting and Secure Delegation](https://mlsanity.com/paper/2310.00953/) (2023)
- [What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale](https://mlsanity.com/paper/2510.13817/) (2025)
- [NOS-Gate: Queue-Aware Streaming IDS for Consumer Gateways under Timing-Controlled Evasion](https://mlsanity.com/paper/2601.00389/) (2026)
- [Automated Identification of Vulnerable Devices in Networks using Traffic Data and Deep Learning](https://mlsanity.com/paper/2102.08199/) (2021)
- [Collaborative adversary nodes learning on the logs of IoT devices in an IoT network](https://mlsanity.com/paper/2112.12546/) (2021)
- [AdIoTack: Quantifying and Refining Resilience of Decision Tree Ensemble Inference Models against Adversarial Volumetric Attacks on IoT Networks](https://mlsanity.com/paper/2203.09792/) (2022)
- [Internet of Things: Digital Footprints Carry A Device Identity](https://mlsanity.com/paper/2301.00328/) (2023)
- [Quantifying and Managing Impacts of Concept Drifts on IoT Traffic Inference in Residential ISP Networks](https://mlsanity.com/paper/2301.06695/) (2023)
- [CNN-based IoT Device Identification: A Comparative Study on Payload vs. Fingerprint](https://mlsanity.com/paper/2304.13894/) (2023)
- [LSTM based IoT Device Identification](https://mlsanity.com/paper/2304.13905/) (2023)
- [IoTFlowGenerator: Crafting Synthetic IoT Device Traffic Flows for Cyber Deception](https://mlsanity.com/paper/2305.00925/) (2023)
- [Locality Sensitive Hashing for Network Traffic Fingerprinting](https://mlsanity.com/paper/2402.08063/) (2024)
- [Communication Traffic Characteristics Reveal an IoT Devices Identity](https://mlsanity.com/paper/2402.16173/) (2024)
- [Analyzing Consumer IoT Traffic from Security and Privacy Perspectives: a Comprehensive Survey](https://mlsanity.com/paper/2403.16149/) (2024)
- [Leveraging Machine Learning for Accurate IoT Device Identification in Dynamic Wireless Contexts](https://mlsanity.com/paper/2405.17442/) (2024)
- [GeMID: Generalizable Models for IoT Device Identification](https://mlsanity.com/paper/2411.14441/) (2024)
- [Improving the network traffic classification using the Packet Vision approach](https://mlsanity.com/paper/2412.19360/) (2024)
- [Algorithmic Data Minimization for Machine Learning over Internet-of-Things Data Streams](https://mlsanity.com/paper/2503.05675/) (2025)
- [REFN: A Reinforcement-Learning-From-Network Framework against 1-day/n-day Exploitations](https://mlsanity.com/paper/2508.10701/) (2025)
- [IoT Device Identification with Machine Learning: Common Pitfalls and Best Practices](https://mlsanity.com/paper/2601.20548/) (2026)
- [From Packets to Patterns: Interpreting Encrypted Network Traffic as Longitudinal Behavioral Signals](https://mlsanity.com/paper/2605.01616/) (2026)
- [Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling](https://mlsanity.com/paper/2608.15465/) (2026)

## Abstract (arXiv)

With the rapid growth of the Internet-of-Things (IoT), concerns about the security of IoT devices have become prominent. Several vendors are producing IP-connected devices for home and small office networks that often suffer from flawed security designs and implementations. They also tend to lack mechanisms for firmware updates or patches that can help eliminate security vulnerabilities. Securing networks where the presence of such vulnerable devices is given, requires a brownfield approach: applying necessary protection measures within the network so that potentially vulnerable devices can coexist without endangering the security of other devices in the same network. In this paper, we present IOT SENTINEL, a system capable of automatically identifying the types of devices being connected to an IoT network and enabling enforcement of rules for constraining the communications of vulnerable devices so as to minimize damage resulting from their compromise. We show that IOT SENTINEL is effective in identifying device types and has minimal performance overhead.