# Quantifying and Managing Impacts of Concept Drifts on IoT Traffic Inference in Residential ISP Networks

arXiv: https://arxiv.org/abs/2301.06695 · HTML: https://mlsanity.com/paper/2301.06695/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 4 of its 19 references that are in the map.
- First posted on arXiv 17 Jan 2023.

## Builds on (most cited first, 4 of 4)

- [IoT Sentinel: Automated Device-Type Identification for Security Enforcement in IoT](https://mlsanity.com/paper/1611.04880/) (2016)
- [A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild](https://mlsanity.com/paper/2009.01880/) (2020)
- [Revisiting IoT Device Identification](https://mlsanity.com/paper/2107.07818/) (2021)
- [IoT Inspector: Crowdsourcing Labeled Network Traffic from Smart Home Devices at Scale](https://mlsanity.com/paper/1909.09848/) (2019)

## Abstract (arXiv)

Millions of vulnerable consumer IoT devices in home networks are the enabler for cyber crimes putting user privacy and Internet security at risk. Internet service providers (ISPs) are best poised to play key roles in mitigating risks by automatically inferring active IoT devices per household and notifying users of vulnerable ones. Developing a scalable inference method that can perform robustly across thousands of home networks is a non-trivial task. This paper focuses on the challenges of developing and applying data-driven inference models when labeled data of device behaviors is limited and the distribution of data changes (concept drift) across time and space domains. Our contributions are three-fold: (1) We collect and analyze network traffic of 24 types of consumer IoT devices from 12 real homes over six weeks to highlight the challenge of temporal and spatial concept drifts in network behavior of IoT devices; (2) We analyze the performance of two inference strategies, namely "global inference" (a model trained on a combined set of all labeled data from training homes) and "contextualized inference" (several models each trained on the labeled data from a training home) in the presence of concept drifts; and (3) To manage concept drifts, we develop a method that dynamically applies the ``closest'' model (from a set) to network traffic of unseen homes during the testing phase, yielding better performance in 20% of scenarios.