ValQID learns which clues are worth checking to identify network devices

Reading beyond a product name

Routers, cameras, gateways and other networked devices often provide Web interfaces for administration. Identifying the vendor and device type behind those interfaces supports asset inventories and security risk assessment. But useful evidence can be scattered across response text, configuration fields, forms and scripts.

Matching known strings is one approach, yet interface updates can invalidate those fingerprints. Semantic analysis offers another: interpreting what an interface element does rather than relying only on its wording. The computational challenge is deciding how much interpretation each response needs. A clear product identifier and an ambiguous configuration page do not necessarily warrant the same work.

The preprint introduces ValQID, a system that combines contextual interpretation with a learned decision about when further analysis is worthwhile.

Connecting clues before interpreting them

ValQID first represents a recorded Web response as a relation graph. Its nodes contain Web objects, while typed connections preserve relationships such as a control belonging to a form or an operation referencing a script. These connections supply local context for questions about an object’s function.

The system can ask, for example, what role a field plays and what the associated submission operation does. Those answers may be more informative together than separately. ValQID therefore considers both individual questions and pairs connected through selected relation templates.

The question library is developed offline using training examples. Candidate questions and templates are screened for their contribution to identification. A pair is retained when its combined evidence improves prediction beyond either question alone and provides a positive interaction benefit. This makes complementarity part of the selection process, rather than assuming every clue has an independent value.

Asking questions without generating explanations

A specialized evaluator, DSEJEV, answers the selected questions. It is adapted from the four-billion-parameter JevK5 decision model using local device-related questions. A larger model supplies training annotations, which three researchers manually review for support in the evidence.

At runtime, DSEJEV returns probabilities over predefined answers in a single forward pass. It does not generate a prose response that must then be parsed. The options include an insufficient-evidence answer.

ValQID attaches the full probability distribution to the relevant object in its graph. For a selected pair, the two questions are evaluated separately, and their results enter the identification state together. The final prediction combines the relational evidence with character-based features from the response and joint vendor–type scoring.

Knowing when to stop

Before executing a question group, ValQID estimates its net value: the expected identification benefit weighed against execution cost, given the evidence already available.

The value model learns from changes in identification loss and measured processing costs. Its training can also account for useful subsequent questions. During identification, ValQID selects the eligible group with the highest predicted net value. It stops if none has positive value, or if its question budget or decision rounds run out.

This is computation selection over an existing response—not a policy for deciding which additional requests to send to a live device.

Results across two datasets

The researchers evaluate ValQID on HTTP responses drawn from DevTag and BLMProbe. The processed datasets contain 75,188 records spanning 80 vendors and 20 device types, and 11,164 responses spanning 67 vendors and five types, respectively. The evaluation uses fixed label vocabularies, with measures to keep identical response content from crossing data partitions.

ValQID achieves joint vendor–type accuracy of 95.30% on DevTag and 96.63% on BLMProbe. Joint accuracy requires both labels to be correct. Its joint macro-F1 scores are 75.65% and 91.90%, compared with 56.25% and 62.47% for the BLMProbe baseline—relative gains of 34.5% and 47.1%.

Macro-F1 gives each class equal weight, making it useful when common vendors dominate the records. For vendors with fewer than 20 training examples, ValQID reaches macro-F1 scores of 66.28% on DevTag and 91.81% on BLMProbe: relative improvements of 82.1% and 74.8% over BLMProbe. The improvements cover a majority, not all, of these low-frequency vendors.

Less semantic work, comparable identification

Compared with fixed-order questioning, value-based selection reduces semantic question counts by 44.74% on DevTag and 53.16% on BLMProbe while maintaining comparable joint identification performance.

Replacing three tested general-purpose semantic evaluators with DSEJEV yields semantic-processing speedups of 3.27–8.58 times. End-to-end throughput improves by a smaller 1.20–1.83 times. These efficiency experiments run on a single NVIDIA H100 80GB GPU.

The experiments use public, recorded responses without additional scans or live interface actions. The authors position ValQID for authorized asset inventory and identify adaptation to firmware and interface changes as future work. Its central contribution is selecting useful combinations of evidence, rather than treating every possible semantic question as equally worth answering.