# Is this IoT Device Likely to be Secure? Risk Score Prediction for IoT Devices Using Gradient Boosting Machines

arXiv: https://arxiv.org/abs/2111.11874 · HTML: https://mlsanity.com/paper/2111.11874/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 23 references that are in the map.
- First posted on arXiv 23 Nov 2021.

## Builds on (most cited first, 6 of 6)

- [Metrics for Multi-Class Classification: an Overview](https://mlsanity.com/paper/2008.05756/) (2020)
- [EDIMA: Early Detection of IoT Malware Network Activity Using Machine Learning Techniques](https://mlsanity.com/paper/1906.09715/) (2019)
- [CVE based classification of vulnerable IoT systems](https://mlsanity.com/paper/2006.16640/) (2020)
- [SHARKS: Smart Hacking Approaches for RisK Scanning in Internet-of-Things and Cyber-Physical Systems based on Machine Learning](https://mlsanity.com/paper/2101.02780/) (2021)
- [Security Risk Assessment in Internet of Things Systems](https://mlsanity.com/paper/1811.03290/) (2018)
- [Towards Decentralized IoT Updates Delivery Leveraging Blockchain and Zero-Knowledge Proofs](https://mlsanity.com/paper/2010.12134/) (2020)

## Abstract (arXiv)

Security risk assessment and prediction are critical for organisations deploying Internet of Things (IoT) devices. An absolute minimum requirement for enterprises is to verify the security risk of IoT devices for the reported vulnerabilities in the National Vulnerability Database (NVD). This paper proposes a novel risk prediction for IoT devices based on publicly available information about them. Our solution provides an easy and cost-efficient solution for enterprises of all sizes to predict the security risk of deploying new IoT devices. After an extensive analysis of the NVD records over the past eight years, we have created a unique, systematic, and balanced dataset for vulnerable IoT devices, including key technical features complemented with functional and descriptive features available from public resources. We then use machine learning classification models such as Gradient Boosting Decision Trees (GBDT) over this dataset and achieve 71% prediction accuracy in classifying the severity of device vulnerability score.