DeviceRadar: Online IoT Device Fingerprinting in ISPs using Programmable Switches
Ruoyu Li, Qing Li, Tao Lin, Qingsong Zou, Dan Zhao, Yucheng Huang,, Gareth Tyson, Guorui Xie, Yong Jiang

TL;DR
DeviceRadar is an innovative online IoT device fingerprinting framework that leverages programmable switches to identify devices accurately and in real-time within ISP networks, overcoming data obscuration and high traffic challenges.
Contribution
It introduces a novel fingerprinting method based on key packets and spatial relationships, enabling deployment on programmable switches for line-speed processing.
Findings
Achieves state-of-the-art accuracy across 77 IoT devices.
Handles 40 Gbps traffic with only 1.3% of GPU processing time.
Operates effectively despite network middleboxes obscuring data.
Abstract
Device fingerprinting can be used by Internet Service Providers (ISPs) to identify vulnerable IoT devices for early prevention of threats. However, due to the wide deployment of middleboxes in ISP networks, some important data, e.g., 5-tuples and flow statistics, are often obscured, rendering many existing approaches invalid. It is further challenged by the high-speed traffic of hundreds of terabytes per day in ISP networks. This paper proposes DeviceRadar, an online IoT device fingerprinting framework that achieves accurate, real-time processing in ISPs using programmable switches. We innovatively exploit "key packets" as a basis of fingerprints only using packet sizes and directions, which appear periodically while exhibiting differences across different IoT devices. To utilize them, we propose a packet size embedding model to discover the spatial relationships between packets.…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
