NDSS 2025 – Machine learning-based LOT device identification model for security applications

With the proliferation of IoT devices, network device identification is essential for effective network management and security. Despite the potential of machine learning-based IoT device identification solutions, many exhibit poor performance. As devices operate in different modes and evolve over time, degradation arises from static IoT environment assumptions that do not account for the diversity of real-world IoT networks. In this paper, we evaluate current IoT device identification solutions using selected datasets and representative features across various settings. We consider important factors that influence real-world device identification, such as operating mode, spatiotemporal variation, and traffic sampling, and organize them into a set of attributes against which current solutions can be evaluated. Next, we use machine learning explainability techniques to identify the main causes of performance degradation. This assessment reveals empirical evidence on what continuously identifies devices and provides network operators with valuable insights and practical recommendations to improve identification of IoT devices in operational deployments.