Investigating HTTP response headers for the classification of devices on the Internet

Devices that are connected to the Internet are of great interest to malicious parties and security researchers alike, as direct remote reachability places them at the highest risk of being attacked, compromised or otherwise abused. To investigate the root causes of the security risks it is necessary to understand what classes of devices are reachable and how they are affected. These devices are numerous and heterogeneous, making it impractical to classify large sets by applying static rules. We have explored which features of the HTTP response headers are useful and what kinds of indicators can be extracted by analysing a whole Internet scan for the HTTP ports 80 and 8080. We propose improvements for manually labelling training sets for use in training neural networks. The results of this research have been applied in creating a labelling tool enabling us to combine different features and markers together, thus decreasing manual workload.