New MUD-based semantic method identifies IoT devices from behavior, not packets

Accurate IoT device identification is crucial for security policy enforcement, but traditional methods relying on low-level packet or flow signatures fail under variable traffic patterns. To address this, Samuel Witt and Hassan Habibi Gharakheili from UNSW Sydney propose a novel semantic identification technique using Manufacturer Usage Description (MUD) profiles. MUD profiles define device behavior via Access Control Entries (ACEs)—each a behavioral primitive capturing protocol, endpoint, direction, and port. The researchers construct semantic vector representations from compact ACE-level text, analyzing their geometric properties across 28 publicly available MUD profiles containing 1,023 ACE instances. They show that ACE-level embeddings preserve device-level distinctions better than whole-profile embeddings and remain effective after whitening calibration.

In evaluation, the team tested semantic ACE matching against exact matching under controlled variations (unseen ACEs, drifted hostnames, partial observation) and on real IoT traffic comprising more than 800,000 observed flows. While exact matching performs well when high overlap with canonical MUD profiles exists, it degrades sharply as overlap becomes sparse. Semantic ACE matching consistently provides stronger identification evidence during early observation stages, retains correct devices among top-ranked candidates, and remains effective under sparse-overlap conditions. This approach promises robust, deployment-agnostic IoT identification—particularly valuable for security teams managing heterogeneous device fleets with evolving behaviors.