A Method of Creating Data for Device-information Extraction by Efficient Wide-area-network Scanning of IoT Devices

In recent years, the number of IoT devices has increased significantly, and accompanying that trend, the number of those devices with insufficient security settings has also increased considerably. Such vulnerable IoT devices can be widely used for cyber-attacks by infecting them with malware that exploits a number of their vulnerabilities. To prevent such cyber-attacks, it is effective to conduct so-called "wide-area-network scanning" that checks security settings by comprehensively scanning ports connected to IoT devices. However, as for scans covering many IoT devices, it is a risk that the amount of communications related to those scans will be enormous; consequently, it is indispensable to implement a wide-area-network scanning system that can sufficiently check IoT devices with the minimum amount of communication traffic so as not to adversely affect the network. As one means of improving the efficiency of such scanning, it is considered effective to narrow-down the target ports to be scanned to a minimum number by extracting the information about the IoT devices from the scan results. In the meantime, to minimize the amount of traffic due to the scanning, it is necessary to improve the accuracy the extraction of IoT-device information as much as possible. A method for limiting the number of target ports for scanning by extracting information about each IoT device from the scan results was first devised. After that, a method for efficiently creating the data that are necessary for extracting the information about an IoT-device from a large amount of banner information was then devised. In the rest of this paper, the extracted information concerning IoT devices created from actual scan results are outlined, and the results of a simulation using the created data are presented.