# Rapid IoT Device Identification at the Edge

arXiv: https://arxiv.org/abs/2110.13941 · HTML: https://mlsanity.com/paper/2110.13941/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 23 references that are in the map.
- First posted on arXiv 26 Oct 2021.

## Builds on (most cited first, 4 of 4)

- [IoT Device Identification Using Deep Learning](https://mlsanity.com/paper/2002.11686/) (2020)
- [The Case for Retraining of ML Models for IoT Device Identification at the Edge](https://mlsanity.com/paper/2011.08605/) (2020)
- [Revisiting IoT Device Identification](https://mlsanity.com/paper/2107.07818/) (2021)
- [Blocking without Breaking: Identification and Mitigation of Non-Essential IoT Traffic](https://mlsanity.com/paper/2105.05162/) (2021)

## Built on by (most cited first, 1 of 1)

- [SunBlock: Cloudless Protection for IoT Systems](https://mlsanity.com/paper/2401.14332/) (2024)

## Abstract (arXiv)

Consumer Internet of Things (IoT) devices are increasingly common in everyday homes, from smart speakers to security cameras. Along with their benefits come potential privacy and security threats. To limit these threats we must implement solutions to filter IoT traffic at the edge. To this end the identification of the IoT device is the first natural step. In this paper we demonstrate a novel method of rapid IoT device identification that uses neural networks trained on device DNS traffic that can be captured from a DNS server on the local network. The method identifies devices by fitting a model to the first seconds of DNS second-level-domain traffic following their first connection. Since security and privacy threat detection often operate at a device specific level, rapid identification allows these strategies to be implemented immediately. Through a total of 51,000 rigorous automated experiments, we classify 30 consumer IoT devices from 27 different manufacturers with 82% and 93% accuracy for product type and device manufacturers respectively.