What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale
arXiv:2510.13817v2 Announce Type: replace Abstract: The growth of IoT devices in shared environments has outpaced our ability to identify them, posing urgent risks to privacy, safety, and accountability. This challenge is especially pronounced in open-world environments, where network traffic metadata is often sparse, noisy, or adversarial. To address this problem, we introduce a semantic inference pipeline that reframes device identification as a language modeling task over real-world network metadata. As this approach depends on reliable supervision, we first construct high-fidelity vendor l
The proliferation of IoT devices in every environment, coupled with rapid advancements in large language models, creates a timely opportunity to address critical security and identification challenges.
Accurate identification of IoT devices is crucial for cybersecurity, privacy, and accountability, particularly as these devices become ubiquitous in critical infrastructure and personal spaces.
The ability to reliably identify previously unknown or obscured IoT devices at scale transforms network monitoring and opens new avenues for proactive security measures and device management.
- · Cybersecurity firms
- · Network administrators
- · IoT device manufacturers (responsible ones)
- · Governments/Regulators
- · Malicious actors
- · IoT device manufacturers (irresponsible security)
- · Traditional network identification tools
Improved network visibility and enhanced security postures for organizations and individuals operating mixed IoT environments.
Increased pressure on IoT manufacturers to provide better identification metadata and adhere to security standards, driven by automated scrutiny.
The potential for AI-driven network intelligence to become a standard feature in critical infrastructure, preempting cyber threats and enforcing compliance at a foundational level.
This signal links to a primary source. Continuum Brief monitors and indexes it as part of the live intelligence stream — we do not republish source content.
Read at arXiv cs.LG