# GeMID: Generalizable Models for IoT Device Identification

arXiv: https://arxiv.org/abs/2411.14441 · HTML: https://mlsanity.com/paper/2411.14441/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 47 references that are in the map.
- First posted on arXiv 5 Nov 2024.

## Builds on (most cited first, 13 of 13)

- [Domain Generalization: A Survey](https://mlsanity.com/paper/2103.02503/) (2021)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [IoT Sentinel: Automated Device-Type Identification for Security Enforcement in IoT](https://mlsanity.com/paper/1611.04880/) (2016)
- [IoTSense: Behavioral Fingerprinting of IoT Devices](https://mlsanity.com/paper/1804.03852/) (2018)
- [IoT Device Identification Using Deep Learning](https://mlsanity.com/paper/2002.11686/) (2020)
- [Revisiting IoT Device Identification](https://mlsanity.com/paper/2107.07818/) (2021)
- [Network Traffic Analysis based IoT Device Identification](https://mlsanity.com/paper/2009.04682/) (2020)
- [IoTDevID: A Behavior-Based Device Identification Method for the IoT](https://mlsanity.com/paper/2102.08866/) (2021)
- [PingPong: Packet-Level Signatures for Smart Home Device Events](https://mlsanity.com/paper/1907.11797/) (2019)
- [Externally validating the IoTDevID device identification methodology using the CIC IoT 2022 Dataset](https://mlsanity.com/paper/2307.08679/) (2023)
- [Individual Packet Features are a Risk to Model Generalisation in ML-Based Intrusion Detection](https://mlsanity.com/paper/2406.07578/) (2024)
- ["Privacy is the Boring Bit": User Perceptions and Behaviour in the Internet-of-Things](https://mlsanity.com/paper/1807.05761/) (2018)
- [IoT Device Identification Based on Network Communication Analysis Using Deep Learning](https://mlsanity.com/paper/2303.12800/) (2023)

## Abstract (arXiv)

With the proliferation of devices on the Internet of Things (IoT), ensuring their security has become paramount. Device identification (DI), which distinguishes IoT devices based on their traffic patterns, plays a crucial role in both differentiating devices and identifying vulnerable ones, closing a serious security gap. However, existing approaches to DI that build machine learning models often overlook the challenge of model generalizability across diverse network environments. In this study, we propose a novel framework to address this limitation and to evaluate the generalizability of DI models across data sets collected within different network environments. Our approach involves a two-step process: first, we develop a feature and model selection method that is more robust to generalization issues by using a genetic algorithm with external feedback and datasets from distinct environments to refine the selections. Second, the resulting DI models are then tested on further independent datasets to robustly assess their generalizability. We demonstrate the effectiveness of our method by empirically comparing it to alternatives, highlighting how fundamental limitations of commonly employed techniques such as sliding window and flow statistics limit their generalizability. Moreover, we show that statistical methods, widely used in the literature, are unreliable for device identification due to their dependence on network-specific characteristics rather than device-intrinsic properties, challenging the validity of a significant portion of existing research. Our findings advance research in IoT security and device identification, offering insight into improving model effectiveness and mitigating risks in IoT networks.