In order to provide security for IoT devices we need to know what devices are connected in the first place. This can be a trivial task if you are the one who installed the devices, but can become much more difficult in BYOD (Bring Your Own Device) environments or ones in which an intruder has installed a device. Using passive network monitoring we are able to identify device types down to the model granularity. Our experiments have shown high accuracy, up to 99%.
What happens when a device has become compromised and starts spoofing already trusted devices? Can we detect which device is performing the spoofing? These are just a couple of questions that we as a group are currently exploring.
