Internet of things device recognition method based on natural language processing and text similarity

Effective identification of Internet of things devices in cyberspace is of great significance to the protection of Cyberspace Security. However, there are a large number of such devices in cyberspace, which can not be identified by the existing methods of identifying IoT devices because of the lack of key information such as manufacturer name and device name in the response message. Their existence brings hidden danger to Cyberspace Security. In order to identify the IoT devices with missing key information in these response messages, this paper proposes an IoT device identification method, IoTCatcher. IoTCatcher uses HTTP response message and the structure and style characteristics of HTML document, and based on natural language processing technology and text similarity technology, classifies and compares the IoT devices whose response message lacks key information, so as to generate their device finger information. This paper proves that the recognition precision of IoTCatcher is 95.29%, and the recall rate is 91.01%. Compared with the existing methods, the overall performance is improved by 38.83%.

I. Introduction

With the development of 5G technology, more and more Internet of things devices access to cyberspace. According to the latest research of Transforma Insights, the number of active IoT devices will reach 7.6 billion by the end of 2019, and it is expected to grow to 24.1 billion by 2030, with a compound annual growth rate (CAGR) of 11%[1]. However, Internet of things devices are vulnerable to hackers because of their low level of self-protection. For example, in 2016, hackers used nearly a million Internet of things devices infected by Mirai virus to launch a DDoS attack on Dyn, a DNS service provider on the east coast of the United States. This attack caused many websites to be inaccessible, including twitter, GitHub, BBC and so on[2].