Bar Meyuhas

ZEAL (Zero-shot Engine for IoT Asset Labeling) is an open-source system that labels never-seen IoT devices by finding their vendor (e.g., Xiaomi, TP-Link) and function (e.g., Light, Plug) based on textual features extracted from the device network traffic, such as domains and hostnames. The system gets as an input features and enriches them using online searches.

Then, it applies a string-matching algorithm to label its vendor and large language model (LLM) to label its function. The system is implemented as a serverless architecture on AWS, ZEAL utilizes services such as Lambda, Elastic File System (EFS), and S3, ensuring scalability but economic implementation. This demonstration showcases ZEAL’s ability to enhance network visibility and asset management by accurately labeling devices with minimal prior knowledge. The system is open-source publicly accessible via API and GUI for research and business applications (https://labelmydevice.com), licensed under the Apache License 2.0.

The IoT market is diverse and characterized by a multitude of vendors that support different device functions (e.g., speaker, camera, vacuum cleaner, etc.). Within this market, IoT security
and observability systems use real-time identification techniques to manage these devices effectively. Most existing IoT identification solutions employ machine learning techniques
that assume the IoT device, labeled by both its vendor and function, was observed during their training phase. We tackle a key challenge in IoT labeling: how can an AI solution
label an IoT device that has never been seen before and whose label is unknown?

Our solution extracts textual features such as domain names and hostnames from network traffic, and then enriches these features using Google search data alongside catalog of vendors
and device functions. The solution also integrates an auto-update mechanism that uses Large Language Models (LLMs) to update these catalogs with emerging device types.
Based on the information gathered, the device’s vendor is identified through string matching with the enriched features.
The function is then deduced by LLMs and zero-shot classification from a predefined catalog of IoT functions. In an evaluation of our solution on 97 unique IoT devices,
our function labeling approach achieved HIT1 and HIT2 scores of 0.7 and 0.77, respectively. As far as we know, this is the first research to tackle AI-automated IoT labeling.

The rapid proliferation of Internet of Things (IoT) technology in various sectors has created new security and management challenges. The cornerstone of any effective security strategy is understanding what assets need protection and discovering the devices connected to the network. The correct identification of an IoT device plays a crucial role in IoT security solutions \cite{PaloAltoNetworks2023, checkpoint, firedome}. Extensive research carried out in both the industry and academia has been dedicated to IoT identification algorithms \cite{le2019policy,guo2018ip,hafeez2020iot,marchal2019audi,aneja2018iot}. These algorithms rely primarily on labeled IoT datasets for the real-time identification of previously \textbf{seen} devices. The algorithms learn each device’s unique network properties and then identify them. However, in the IoT realm, maintaining a lab with every possible IoT device is simply not feasible.

This poster argues that IoT labeling is an imperative challenge and introduces an approach that \textit{labels} unseen IoT devices by their type: \textit{vendor, function}.
The motivation to address it was born from discussions with IoT security companies that have difficulty labeling IoT devices in the wild.

We explore the impact of device location on the communication endpoints of IoT devices within the context of Manufacturer Usage Description (MUD), an IETF security framework for IoT devices.
Two types of device location are considered: IP-based location, which corresponds to the physical location of the device based on its IP address; and user-defined location, which is chosen during device registration.
Our findings show that IP-based location barely affects the domain set with which IoT devices interact. Conversely, user-defined location drastically changes this set, mainly through region-specific domains that embody location identifiers selected by the user at registration.
We examine these findings’ effects on creating MUD file tools and IoT device identification. As MUD files rely on allowlists of domain allowlists, we show that security appliances supporting MUD need to manage a significantly larger number of MUD rules than initially anticipated. 
To address this challenge, we leverage EDNS Client Subnet (ECS) extension to differentiate user-defined locations without needing regional domains, consequently reducing the number of Access Control Entries (ACEs) required by security appliances.

Analyzing the network behavior of IoT devices, including which domains, protocols, and ports the device communicates with, is a fundamental challenge for IoT security and identification. Solutions that analyze and manage these areas must be able to learn what constitutes normal device behavior and then extract rules and features to permit only legitimate behavior or identify the device. The Manufacturer Usage Description (MUD) is an IETF white-list protection scheme that formalizes the authorized network behavior in a MUD file; this MUD file can then be used as a type of firewall mechanism.

We demonstrate that learning what is normal behavior for an IoT device is more challenging than expected. In many cases, the same IoT device, with the same firmware, can exhibit different behavior or connect to different domains with different protocols, depending on the device’s geographical location.

Then, we present a technique to generalize MUD files. By processing MUD files that originate in different locations, we can generalize and create a comprehensive MUD file that is applicable for all locations.
To conduct the research, we created MUDIS, a MUD Inspection System tool, that compares and generalizes MUD files. Our open-source MUDIS tool and dataset are available online to researchers and IoT manufacturers, allowing anyone to visualize, compare, and generalize MUD files.