Abstract: Systems, methods, and devices for identifying and responding to illegitimate devices on a service provider network include computing devices that are configured to collect dynamic host configuration protocol (DHCP) information related to a device (e.g., a modem, etc.) that establishes or requests to establish an internet protocol (IP) connection to the service provider network. The computing devices may determine features based on the collected DHCP information, apply the determined features to a classification model, and predict whether the device is an illegitimate device based on a result of applying the determined features to the classification model. The computing devices may perform a responsive action (e.g., blacklist or quarantine the device, etc.) in response to predicting that the device is an illegitimate device.

Abstract: Systems, methods, and devices for identifying and responding to illegitimate devices on a service provider network include computing devices that are configured to collect dynamic host configuration protocol (DHCP) information related to a device (e.g., a modem, etc.) that establishes or requests to establish an internet protocol (IP) connection to the service provider network. The computing devices may determine features based on the collected DHCP information, apply the determined features to a classification model, and predict whether the device is an illegitimate device based on a result of applying the determined features to the classification model. The computing devices may perform a responsive action (e.g., blacklist or quarantine the device, etc.) in response to predicting that the device is an illegitimate device.