Attack vectors for adversaries have increased in organizations because of the
growing use of less secure IoT devices. The risk of attacks on an
organization's network has also increased due to the bring your own device
(BYOD) policy which permits employees to bring IoT devices onto the premises
and attach them to the organization's network. To tackle this threat and
protect their networks, organizations generally implement security policies in
which only white listed IoT devices are allowed on the organization's network.
To monitor compliance with such policies, it has become essential to
distinguish IoT devices permitted within an organization's network from non
white listed (unknown) IoT devices. In this research, deep learning is applied
to network communication for the automated identification of IoT devices
permitted on the network. In contrast to existing methods, the proposed
approach does not require complex feature engineering of the network
communication, because the 'communication behavior' of IoT devices is
represented as small images which are generated from the device's network
communication payload. The proposed approach is applicable for any IoT device,
regardless of the protocol used for communication. As our approach relies on
the network communication payload, it is also applicable for the IoT devices
behind a network address translation (NAT) enabled router. In this study, we
trained various classifiers on a publicly accessible dataset to identify IoT
devices in different scenarios, including the identification of known and
unknown IoT devices, achieving over 99% overall average detection accuracy.

该研究应用深度学习来自动识别组织内允许接入的 IoT 设备，以增强网络安全。相较于现有的方法，该方法不需要对网络通讯进行复杂的特征工程，而是通过生成设备通讯负载的小图片来表征 IoT 设备的通信行为。该方法可适用于任何协议的 IoT 设备，及网络地址转换（NAT）启用的路由器。在公开数据集上进行的多种场景测试表明，该方法对已知和未知的 IoT 设备都可以达到 99% 以上的识别准确度。