Toward a better understanding of IoT domain names : a study of IoT backend

Abstract

In this paper, we study Internet of Things (IoT) domain names, the domain names of backend servers on the Internet that are accessed by IoT devices. We investigate how they compare to non-IoT domain names based on their statistical and DNS properties and the feasibility of classifying these two classes of domain names using machine learning (ML). We construct a dataset of IoT domain names by surveying past studies that used testbeds with real IoT devices. For the non-IoT dataset, we use two lists of top-visited websites. We study the statistical and DNS properties of the domain names. We also leverage machine learning and train six models to perform the classification between the two classes of domain names. The word embedding technique we use to get the real-valued vector representation of the domain names is Word2vec. Our statistical analysis highlights significant differences in domain name length, label frequency, and compliance with typical domain name construction guidelines, while our DNS analysis reveals notable variations in resource record availability and configuration between IoT and non-IoT DNS zones. As for classifying IoT and non-IoT domain names using machine learning, Random Forest achieves the highest performance among the models we train, yielding the highest accuracy, precision, recall, and F<inf>1</inf> score. Our work offers novel insights to IoT, potentially informing protocol design and aiding in network security and performance monitoring.