# Unsupervised Baseline Clustering and Incremental Adaptation for IoT Device Traffic Profiling

arXiv: https://arxiv.org/abs/2602.24047 · HTML: https://mlsanity.com/paper/2602.24047/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 20 references that are in the map.
- First posted on arXiv 27 Feb 2026.

## Builds on (most cited first, 3 of 3)

- [Revisiting IoT Device Identification](https://mlsanity.com/paper/2107.07818/) (2021)
- [Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT](https://mlsanity.com/paper/2109.02544/) (2021)
- [Enhancing IoT Security via Automatic Network Traffic Analysis: The Transition from Machine Learning to Deep Learning](https://mlsanity.com/paper/2312.00034/) (2023)

## Abstract (arXiv)

The growth and heterogeneity of IoT devices create security challenges where static identification models can degrade as traffic evolves. This paper presents a two-stage, flow-feature-based pipeline for unsupervised IoT device traffic profiling and incremental model updating, evaluated on selected long-duration captures from the Deakin IoT dataset. For baseline profiling, density-based clustering (DBSCAN) isolates a substantial outlier portion of the data and produces the strongest alignment with ground-truth device labels among tested classical methods (NMI 0.78), outperforming centroid-based clustering on cluster purity. For incremental adaptation, we evaluate stream-oriented clustering approaches and find that BIRCH supports efficient updates (0.13 seconds per update) and forms comparatively coherent clusters for a held-out novel device (purity 0.87), but with limited capture of novel traffic (share 0.72) and a measurable trade-off in known-device accuracy after adaptation (0.71). Overall, the results highlight a practical trade-off between high-purity static profiling and the flexibility of incremental clustering for evolving IoT environments.