arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2602.15263

A Scan-Based Analysis of Internet-Exposed IoT Devices Using Shodan Data

Richelle Williams·Fernando Koch
View original source ↗Read source document ↗Export metadata ↓

Abstract

An open measurement problem in IoT security is whether scan-observable network configurations encode population-level exposure risk beyond individual devices. An analysis of internet-exposed IoT endpoints using a controlled multi-country sample from Shodan Search and Shodan InternetDB, selecting 100 hosts identified via TCP port 7547 (TR-069/CWMP) and evenly distributed across the ten most represented countries. Hosts are enriched with scan-derived metadata and analyzed using feature-relevance assessment, cross-country comparisons of open and risky port exposure, and supervised classification of higher-risk exposure profiles. The analysis reveals consistent cross-country differences in exposure structure, with mean risky-port counts ranging from 0.4 to 1.0 per host, and achieves balanced accuracy of approximately 0.61 when classifying higher-risk exposure profiles.

Explore related subjects

cs.CRcs.NI

Keep this discovery

BibTeXRIS

Richelle Williams, Fernando Koch. 2026-02-16. A Scan-Based Analysis of Internet-Exposed IoT Devices Using Shodan Data. https://doi.org/10.37256/est.81202710466

Cite the original work for its findings. Save a collection to share your selection of sources.

Discover connections

cs.CR subjectcs.NI subject

Connections use source metadata and explicit phrase matches, not verified experimental comparisons.

KEEP EXPLORING

Related papers

arXiv2026

Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems

This paper investigates the temporal analysis of NetFlow datasets for machine learning (ML)-based network intrusion detection systems (NIDS). Although many previous studies have highlighted the critical role of temporal features, such as inter-packet arrival time and flow length/duration, in NIDS, the currently available NetFlow datasets for NIDS lack these temporal features. This study addresses this gap by creating and making publicly available a set of NetFlow datasets that incorporate these temporal features [1]. With these temporal features, we provide a comprehensive temporal analysis of NetFlow datasets by examining the distribution of various features over time and presenting time-series representations of NetFlow features. This temporal analysis has not been previously provided in the existing literature. We also borrowed an idea from signal processing, time frequency analysis, and tested it to see how different the time frequency signal presentations (TFSPs) are for various attacks. The results indicate that many attacks have unique patterns, which could help ML models to identify them more easily.

cs.LG↗
arXiv2026

SecDT: A Profile-Based Security Layer for TRDP Communications

The Train Real-time Data Protocol (TRDP) is widely used on rolling stock but it provides limited native support for cryptographic protection. Furthermore, the multicast traffic profile used in TRDP Process Data to exchange critical information between onboard subsystems makes the introduction of cryptographic protection a challenge. This paper presents a lightweight security layer for secure TRDP communication that implements a number of security profiles built around modern cryptographic algorithms. This additional layer relies on an On-board Key Management System (OKMS) for both security profile negotiation, dynamic key distribution and key lifecycle management. The security profiles allow for cryptographic agility and flexibility, ranging from simple authentication to Authenticated Encryption with Associated Data (AEAD) algorithms. The security profile negotiation procedure guarantees all TRDP End Devices (ED) on a common Communication ID (ComID) share the same security profile and can therefore process each other's messages. A prototype implementation based on mbedTLS and Arm Platform Security Architecture (PSA) was developed and evaluated. Experimental results demonstrate manageable overhead, suitable for the real-time and time-sensitive communication found on rolling stock.

cs.CR↗
arXiv2026

Lacan: Making Accountability in Anonymous Networks Real

Anonymity and accountability are essential properties for our everyday activity on the Internet. However, they appear contradictory, and their reconciliation remains far from reality. Existing approaches fall short in this regard, as they either rely on an on-path trustee, per-packet authorization, per-packet public-key cryptography, or per-session intervention by a central authority. We propose Lacan, a protocol that reconciles anonymity and accountability within a realistic design. In Lacan, a sender enjoys anonymity provided by on-path relays, as long as she complies with a contract established with the receiver. Upon a contract violation, the verifier, an off-path trustee on behalf of the receiver, links the malicious message to the sender's identity indirectly via the packet, path, and session, thereby reducing public-key operations from per-packet to per-session. This linkage remains robust even against malicious relays and receivers, grounded in our novel chain of successor proofs for accountable path reconstruction, together with traceable signatures, path validation, and key-committing encryption. We analyze the anonymity and accountability, implement the protocol, and evaluate the performance.

cs.NI↗