{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T09:04:48Z","timestamp":1780995888734,"version":"3.54.1"},"reference-count":39,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,5,21]],"date-time":"2026-05-21T00:00:00Z","timestamp":1779321600000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1016\/j.cose.2026.104974","type":"journal-article","created":{"date-parts":[[2026,5,21]],"date-time":"2026-05-21T06:42:46Z","timestamp":1779345766000},"page":"104974","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["An analysis of IoT device update mechanisms"],"prefix":"10.1016","volume":"169","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8657-3448","authenticated-orcid":false,"given":"Ashley","family":"Andrews","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1684-6989","authenticated-orcid":false,"given":"George","family":"Oikonomou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Simon","family":"Armour","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Paul","family":"Thomas","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-2069-4922","authenticated-orcid":false,"given":"Thomas","family":"Cattermole","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.cose.2026.104974_b1","series-title":"IEEE International Conference on Communications","article-title":"Automated IoT device identification using network traffic","author":"Aksoy","year":"2019"},{"key":"10.1016\/j.cose.2026.104974_b2","first-page":"1362","article-title":"SoK: security evaluation of home-based IoT deployments","volume":"vol. 2019-May","author":"Alrawi","year":"2019"},{"key":"10.1016\/j.cose.2026.104974_b3","series-title":"Network-protocol-based IoT device identification","first-page":"204","author":"Ammar","year":"2019"},{"key":"10.1016\/j.cose.2026.104974_b4","series-title":"FMEC\u201922","first-page":"79","article-title":"Keyword extraction for fine-grained iot device identification","author":"Andrews","year":"2022"},{"key":"10.1016\/j.cose.2026.104974_b5","series-title":"Reliable Identification of IoT Devices from Passive Network Traffic Analysis: Requirements and Recommendations","author":"Andrews","year":"2023"},{"key":"10.1016\/j.cose.2026.104974_b6","series-title":"Proceedings of the 5th Workshop on CPS&IoT Security and Privacy","article-title":"Granular IoT device identification using TF-IDF and cosine similarity","author":"Andrews","year":"2023"},{"issue":"3","key":"10.1016\/j.cose.2026.104974_b7","doi-asserted-by":"crossref","DOI":"10.1145\/3799713","article-title":"IoT firmware version identification using transfer learning with twin neural networks","volume":"26","author":"Andrews","year":"2026","journal-title":"ACM Trans. Internet Technol."},{"issue":"2","key":"10.1016\/j.cose.2026.104974_b8","doi-asserted-by":"crossref","DOI":"10.3390\/s24020708","article-title":"A review of IoT firmware vulnerabilities and auditing techniques","volume":"24","author":"Bakhshi","year":"2024","journal-title":"Sensors"},{"key":"10.1016\/j.cose.2026.104974_b9","series-title":"Insecurity in the internet of things, symantec security response","author":"Barcena","year":"2015"},{"issue":"2","key":"10.1016\/j.cose.2026.104974_b10","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1109\/MCOM.001.1900125","article-title":"Over-the-air software updates in the internet of things: an overview of key principles","volume":"58","author":"Bauwens","year":"2020","journal-title":"IEEE Commun. Mag."},{"key":"10.1016\/j.cose.2026.104974_b11","series-title":"Smart doorbells \u2019easy target for hackers\u2019 study finds","author":"BBC","year":"2020"},{"key":"10.1016\/j.cose.2026.104974_b12","series-title":"Firmware update attacks and security for IoT devices survey","author":"Bettayeb","year":"2019"},{"key":"10.1016\/j.cose.2026.104974_b13","series-title":"Foundations and Practice of Security","first-page":"406","article-title":"Towards characterizing IoT software update practices","author":"Bradley","year":"2023"},{"key":"10.1016\/j.cose.2026.104974_b14","doi-asserted-by":"crossref","first-page":"1272","DOI":"10.1109\/JIOT.2020.3035087","article-title":"Locality-sensitive IoT network traffic fin- gerprinting for device identification","volume":"8","author":"Charyyev","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.cose.2026.104974_b15","unstructured":"Cui, A., Costello, M., Stolfo, S.J., 2013. When firmware modifications attack: A case study of embedded exploitation. In: 20th Annual Network Distributed System Security Symposium."},{"key":"10.1016\/j.cose.2026.104974_b16","doi-asserted-by":"crossref","first-page":"816","DOI":"10.1109\/TSE.2022.3163969","article-title":"A large-scale analysis of IoT firmware version distribution in the wild","volume":"49","author":"Ebbers","year":"2023","journal-title":"IEEE Trans. Softw. Eng."},{"issue":"10","key":"10.1016\/j.cose.2026.104974_b17","doi-asserted-by":"crossref","first-page":"5769","DOI":"10.1109\/TMC.2022.3183118","article-title":"Autoiot: automatically updated IoT device identification with semi-supervised learning","volume":"22","author":"Fan","year":"2023","journal-title":"IEEE Trans. Mob. Comput."},{"key":"10.1016\/j.cose.2026.104974_b18","series-title":"Consumer attitudes towards IoT security","author":"gov.uk","year":"2020"},{"key":"10.1016\/j.cose.2026.104974_b19","series-title":"Updating IoT Devices: Challenges and Potential Approaches","first-page":"1","author":"Hernandez-Ramos","year":"2020"},{"key":"10.1016\/j.cose.2026.104974_b20","series-title":"Aot - Attack on Things: a Security Analysis of Iot Firmware Updates","first-page":"1047","author":"Ibrahim","year":"2023"},{"key":"10.1016\/j.cose.2026.104974_b21","series-title":"Software updates for internet of things (suit) working group","author":"IETF","year":"2025"},{"key":"10.1016\/j.cose.2026.104974_b22","article-title":"A survey on IoT firmware security","volume":"20","author":"Katbi","year":"2023","journal-title":"Int. J. Comput. Digit. Syst."},{"key":"10.1016\/j.cose.2026.104974_b23","series-title":"Secure firmware updates for IoT: A survey","first-page":"112","author":"Kolehmainen","year":"2018"},{"issue":"6","key":"10.1016\/j.cose.2026.104974_b24","doi-asserted-by":"crossref","first-page":"1402","DOI":"10.1109\/JSAC.2019.2904364","article-title":"AuDI: toward autonomous IoT device-type identification using periodic communication","volume":"37","author":"Marchal","year":"2019","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"10.1016\/j.cose.2026.104974_b25","series-title":"2020 IEEE\/ACM Fifth International Conference on Internet-of-Things Design and Implementation","first-page":"203","article-title":"Characterizing smart home IoT traffic in the wild","author":"Mazhar","year":"2020"},{"key":"10.1016\/j.cose.2026.104974_b26","series-title":"Proceedings of the ACM Symposium on Applied Computing","first-page":"506","article-title":"Profiliot: A machine learning approach for IoT device identification based on network traffic analysis","author":"Meidan","year":"2017"},{"key":"10.1016\/j.cose.2026.104974_b27","series-title":"Detection of unauthorized iot devices using machine learning techniques","author":"Meidan","year":"2017"},{"key":"10.1016\/j.cose.2026.104974_b28","series-title":"Proceedings - International Conference on Distributed Computing Systems","first-page":"2177","article-title":"IoT sentinel: Automated device-type identification for security enforcement in IoT","author":"Miettinen","year":"2017"},{"key":"10.1016\/j.cose.2026.104974_b29","series-title":"DIoT: A self-learning system for detecting compromised IoT devices","first-page":"442","author":"Nguyen","year":"2019"},{"key":"10.1016\/j.cose.2026.104974_b30","series-title":"Proceedings of the International Conference on Internet of Things Design and Implementation","first-page":"106","article-title":"Devicemien: network device behavior modeling for identifying unknown IoT devices","author":"Ortiz","year":"2019"},{"issue":"2","key":"10.1016\/j.cose.2026.104974_b31","doi-asserted-by":"crossref","DOI":"10.1145\/3510360","article-title":"Risk prediction of IoT devices based on vulnerability analysis","volume":"25","author":"Oser","year":"2022","journal-title":"ACM Trans. Priv. Secur."},{"key":"10.1016\/j.cose.2026.104974_b32","doi-asserted-by":"crossref","unstructured":"Perdisci, R., Papastergiou, T., Alrawi, O., Antonakakis, M., 2020. Iotfinder: Efficient large-scale identification of IoT devices via passive DNS traffic analysis. In: Proc. EuroS&P.","DOI":"10.1109\/EuroSP48549.2020.00037"},{"key":"10.1016\/j.cose.2026.104974_b33","series-title":"Inferring software update practices on smart home IoT devices through user agent analysis","first-page":"93","author":"Prakash","year":"2022"},{"key":"10.1016\/j.cose.2026.104974_b34","series-title":"IoT Behavioral Monitoring Via Network Traffic Analysis","author":"Sivanathan","year":"2020"},{"issue":"8","key":"10.1016\/j.cose.2026.104974_b35","doi-asserted-by":"crossref","first-page":"1745","DOI":"10.1109\/TMC.2018.2866249","article-title":"Classifying IoT devices in smart environments using network traffic characteristics","volume":"18","author":"Sivanathan","year":"2019","journal-title":"IEEE Trans. Mob. Comput."},{"key":"10.1016\/j.cose.2026.104974_b36","series-title":"Connected tech: smart or sinister?","author":"UK Parliament","year":"2023"},{"issue":"1","key":"10.1016\/j.cose.2026.104974_b37","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1007\/s43926-023-00045-2","article-title":"A survey on IoT & embedded device firmware security: architecture, extraction techniques, and vulnerability analysis frameworks","volume":"3","author":"Ul Haq","year":"2023","journal-title":"Discov. Internet Things"},{"key":"10.1016\/j.cose.2026.104974_b38","first-page":"769","volume":"vol. 2017-December","author":"Xie","year":"2017"},{"key":"10.1016\/j.cose.2026.104974_b39","series-title":"Security in product lifecycle of IoT devices: A survey","author":"Yousefnezhad","year":"2020"}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826001501?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826001501?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T08:44:35Z","timestamp":1780994675000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826001501"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":39,"alternative-id":["S0167404826001501"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.104974","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"An analysis of IoT device update mechanisms","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.104974","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"104974"}}