FlagThis

Abstract

Accurate identification of Internet of Things (IoT) devices, such as cameras, lightbulbs, and voice assistants, is important for security management and policy enforcement. Existing approaches typically learn device signatures from packets or flow records. These methods operate on low-level communication observations whose traffic patterns may vary across deployments, software versions, and user interactions. This paper studies device identification using Manufacturer Usage Description (MUD) profiles. MUD profiles describe device behavior using Access Control Entries (ACEs), where each ACE represents a behavioral primitive consisting of protocol, endpoint, direction, and port semantics derived from device communication policy. Our specific contributions are threefold. (1) Using 28 publicly available MUD profiles containing 1,023 ACE instances, we construct ACE-level semantic representations from compact behavioral text and evaluate how well they separate device behavior in the embedding space. We show that ACE-level representations preserve device-level behavioral distinctions more effectively than whole-profile embeddings and remain effective after whitening calibration. (2) We then evaluate whether this representation preserves device identity under controlled runtime variations, including unseen ACEs, drifted hostnames, and partial runtime observation. Exact ACE matching performs well when the runtime ACE overlap remains high, but it degrades sharply when the overlap becomes sparse or disappears. In contrast, semantic ACE matching preserves useful identification evidence across these stress-test conditions. (3) Finally, we evaluate the same identification approaches on real IoT traffic traces comprising more than 800,000 observed flows by converting runtime flows into ACElike behavioral primitives and progressively accumulating runtime observations. Exact overlap remains the strongest signal when stable overlap exists, while semantic ACE matching provides stronger identification evidence during the early stages of observation, frequently retaining the correct device among the highestranked candidates and remaining effective under sparse-overlap runtime traffic. These results show that semantic ACE matching can complement exact overlap matching when runtime behavior deviates from canonical device profiles.