IoT Device Fingerprinting on Commodity Switches

IoT devices such as wearables, voice assistants and home appliances are becoming an integral part of our lives. However, these devices still represent a security and privacy risk with large-scale coordinated attacks often populating the news. The ability to tell which IoT devices are where in a network (i.e., to fingerprint them) can help administrators to mitigate such attacks at the earliest stages. While fingerprinting solutions exist, they often work offline, depend on sampled data or rely on payload information to work. In this paper, we propose PoirIoT, a high-speed in-network system for fingerprinting IoT devices. PoirIoT is based only on packet metadata (e.g., length and direction) and can detect a device as soon as it exchanges its first packets. We implement a prototype of PoirIoT on a Tofino-based programmable switch and show it can detect all possible IoT devices on a publicly available dataset. Moreover, PoirIoT runs at line rate and incurs minimal resource overhead on the programmable switch ASIC.