Systems and methods for fingerprinting devices

A system for fingerprinting devices, the system comprising:

• a detection module, stored in memory, that detects that a new device has attempted to connect to a network gateway;
• a fingerprinting module, stored in memory, that attempts to fingerprint the new device as an instance of a known candidate device type by:
• transmitting to the new device, as part of a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type;
• and
• confirming, as part of the security application and based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type;
• a performance module, stored in memory, that performs a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type;
• and
• at least one physical processor configured to execute the detection module, the fingerprinting module, and the performance module;
• wherein the fingerprinting module is configured to identify the set of network messages by:
• crawling an online application distribution platform;
• performing a network message analysis for each one of multiple device-specific applications extracted from the online application distribution platform;
• and
• detecting, based on each respective network message analysis, a respective set of network messages that uniquely identifies each one of the multiple device-specific applications.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• detect that a new device has attempted to connect to a network gateway;
• attempt to fingerprint the new device as an instance of a known candidate device type by:
• transmitting to the new device, by a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type;
• and
• confirming, by the security application based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type;
• and
• perform a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type;
• wherein the set of network messages is identified by:
• crawling an online application distribution platform;
• performing a network message analysis for each one of multiple device-specific applications extracted from the online application distribution platform;
• and
• detecting, based on each respective network message analysis, a respective set of network messages that uniquely identifies each one of the multiple device-specific applications.