Toward a Better Understanding of IoT Domain Names: A Study of IoT Backend

In this paper, we study IoT domain names, the domain names of backend servers on the Internet that are accessed by IoT devices. We investigate how they compare to non-IoT domain names based on their statistical and DNS properties, and the feasibility of classifying these two classes of domain names using machine learning (ML). By surveying past studies that used testbeds with real IoT devices, we construct a dataset of IoT domain names. For the non-IoT dataset,We use two lists of top-visited websites. We study the statistical properties of the domain name lists and their DNS properties. We also leverage machine learning and train six machine learning models to perform the classification between the two classes of domain names. The word embedding technique we use to get the real-value representation of the domain names is Word2vec. Our statistical analysis highlights significant differences in domain name length, label frequency, and compliance typical to domain name guidelines, while our DNS analysis reveals notable variations in resource record availability and configuration between IoT and non-IoT DNS zones. As for classification of IoT and non-IoT domain names using machine learning, among the models we train, Random Forest achieves the highest performance, yielding the highest accuracy, precision, recall, and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">F</i><sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> score. Our work offers novel insights to IoT, potentially informing protocol design and aiding in network security and performance monitoring.