Search papers, labs, and topics across Lattice.
This paper investigates the identification of IoT devices using Manufacturer Usage Description (MUD) profiles, focusing on the semantic representation of behavioral primitives known as Access Control Entries (ACEs). By analyzing 28 MUD profiles and over 800,000 IoT traffic flows, the authors demonstrate that semantic ACE matching outperforms traditional exact matching methods, particularly in scenarios with sparse overlap or runtime variations. The findings reveal that while exact matching is effective under stable conditions, semantic ACE matching consistently retains identification accuracy even when faced with unseen ACEs or drifted hostnames.
Semantic ACE matching retains identification accuracy in IoT devices even under challenging conditions, outperforming traditional methods when traffic patterns vary.
Accurate identification of IoT devices is important for security management and policy enforcement. Existing approaches typically learn device signatures from packets or flow records. These methods operate on low-level communication observations whose traffic patterns may vary across deployments, software versions, and user interactions. This paper studies device identification using Manufacturer Usage Description (MUD) profiles. MUD profiles describe device behavior using Access Control Entries (ACEs), where each ACE represents a behavioral primitive consisting of protocol, endpoint, direction, and port semantics derived from device communication policy. Our contributions are threefold. First, using 28 publicly available MUD profiles containing 1,023 ACE instances, we construct ACE-level semantic representations from compact behavioral text and analyze their geometric properties. ACE-level representations preserve device-level behavioral distinctions more effectively than whole-profile embeddings and remain effective after whitening calibration. Second, we evaluate semantic ACE matching under controlled runtime variations, including unseen ACEs, drifted hostnames, and partial runtime observation. Exact ACE matching performs well when the overlap with the canonical MUD profile remains high, but degrades sharply when the overlap becomes sparse or disappears. In contrast, semantic ACE matching preserves useful identification evidence across these conditions. Third, we evaluate the same approach on real IoT traffic traces comprising more than 800,000 observed flows. Exact overlap remains the strongest signal when stable overlap exists, while semantic ACE matching provides stronger identification evidence during the early stages of observation, frequently retains the correct device among the highest-ranked candidates, and remains effective under sparse-overlap runtime traffic.
