Systems and methods for fingerprinting devices

1. A computer-implemented method for fingerprinting devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

detecting that a new device has attempted to connect to a network gateway;

attempting to fingerprint the new device as an instance of a known candidate device type by:

transmitting to the new device, by a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type; and

confirming, by the security application based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type; and

performing a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type;

wherein the set of network messages is identified by:

crawling an online application distribution platform;

performing a network message analysis for each one of multiple device-specific applications extracted from the online application distribution platform; and

detecting, based on each respective network message analysis, a respective set of network messages that uniquely identifies each one of the multiple device-specific applications.

2. The computer-implemented method of claim 1 , wherein the network gateway executes the security application.

3. The computer-implemented method of claim 1 , wherein the set of network messages is unique according to a backend server analysis of multiple device-specific applications.

4. The computer-implemented method of claim 3 , wherein the backend server analysis of multiple device-specific applications indicates that the second application is configured to transmit the set of network messages while a remainder of the multiple device-specific applications is not so configured.

5. The computer-implemented method of claim 1 , wherein the network message analysis comprises at least one of:

dynamic analysis based on an execution of a respective device-specific application;

static analysis based on disassembling code for the respective device-specific application; or

symbolic execution of the respective device-specific application.

6. The computer-implemented method of claim 1 , wherein the new device comprises an Internet-of-things device.

7. The computer-implemented method of claim 6 , wherein the second application is specific to the Internet-of-things device and comprises an Internet-of-things management application that executes on a user mobile device to pair the user mobile device with the Internet-of-things device and manage the Internet-of-things device.

8. The computer-implemented method of claim 1 , wherein fingerprinting the new device comprises identifying at least two of:

a make of the new device;

a type of the new device;

a model of the new device; and

a firmware version of firmware installed on the new device.

9. The computer-implemented method of claim 1 , wherein the set of network messages is extracted based on an analysis of the second application.

10. The computer-implemented method of claim 9 , wherein the set of network messages is extracted based on the analysis of the second application without access to any instance of the known candidate device type.

11. A system for fingerprinting devices, the system comprising:

a detection module, stored in memory, that detects that a new device has attempted to connect to a network gateway;

a fingerprinting module, stored in memory, that attempts to fingerprint the new device as an instance of a known candidate device type by:

transmitting to the new device, as part of a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type; and

confirming, as part of the security application and based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type;

a performance module, stored in memory, that performs a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type; and

at least one physical processor configured to execute the detection module, the fingerprinting module, and the performance module;

wherein the fingerprinting module is configured to identify the set of network messages by:

crawling an online application distribution platform;

performing a network message analysis for each one of multiple device-specific applications extracted from the online application distribution platform; and

detecting, based on each respective network message analysis, a respective set of network messages that uniquely identifies each one of the multiple device-specific applications.

12. The system of claim 11 , wherein the network gateway executes the security application.

13. The system of claim 11 , wherein the set of network messages is unique according to a backend server analysis of multiple device-specific applications.

14. The system of claim 13 , wherein the backend server analysis of multiple device-specific applications indicates that the second application is configured to transmit the set of network messages while a remainder of the multiple device-specific applications is not so configured.

15. The system of claim 11 , wherein the network message analysis comprises at least one of:

dynamic analysis based on an execution of a respective device-specific application;

static analysis based on disassembling code for the respective device-specific application; or

symbolic execution of the respective device-specific application.

16. The system of claim 11 , wherein the new device comprises an Internet-of-things device.

17. The system of claim 16 , wherein the second application is specific to the Internet-of-things device and comprises an Internet-of-things management application that executes on a user mobile device to pair the user mobile device with the Internet-of-things device and manage the Internet-of-things device.

18. The system of claim 11 , wherein the fingerprinting module fingerprints the new device by identifying at least two of:

a make of the new device;

a type of the new device;

a model of the new device; and

a firmware version of firmware installed on the new device.

19. The system of claim 11 , wherein the set of network messages is extracted based on an analysis of the second application.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

detect that a new device has attempted to connect to a network gateway;

attempt to fingerprint the new device as an instance of a known candidate device type by:

transmitting to the new device, by a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type; and

confirming, by the security application based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type; and

perform a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type;

wherein the set of network messages is identified by:

crawling an online application distribution platform;

performing a network message analysis for each one of multiple device-specific applications extracted from the online application distribution platform; and

detecting, based on each respective network message analysis, a respective set of network messages that uniquely identifies each one of the multiple device-specific applications.