Generalizable IoT Traffic Representations for Cross-Network Device Identification

TL;DR

The paper tackles generalization in IoT device identification by learning compact per-flow embeddings from unlabeled traffic using unsupervised encoder–decoder models and evaluating downstream classification with a frozen-encoder protocol. It demonstrates that latent-regularized representations, via VAEs, maintain robustness across unseen environments better than deterministic autoencoders or large pretrained encoders, achieving macro F1 scores exceeding 0.9 on multiple datasets. A fixed, lightweight classifier trained on frozen embeddings attains strong performance, highlighting that representation quality drives most discrimination rather than classifier complexity. The work benchmarks against state-of-the-art pretrained encoders and shows that carefully designed, smaller models with latent regularization offer practical, scalable, and transferable IoT traffic inference for cross-network device identification.

Abstract

Machine learning models have demonstrated strong performance in classifying network traffic and identifying Internet-of-Things (IoT) devices, enabling operators to discover and manage IoT assets at scale. However, many existing approaches rely on end-to-end supervised pipelines or task-specific fine-tuning, resulting in traffic representations that are tightly coupled to labeled datasets and deployment environments, which can limit generalizability. In this paper, we study the problem of learning generalizable traffic representations for IoT device identification. We design compact encoder architectures that learn per-flow embeddings from unlabeled IoT traffic and evaluate them using a frozen-encoder protocol with a simple supervised classifier. Our specific contributions are threefold. (1) We develop unsupervised encoder--decoder models that learn compact traffic representations from unlabeled IoT network flows and assess their quality through reconstruction-based analysis. (2) We show that these learned representations can be used effectively for IoT device-type classification using simple, lightweight classifiers trained on frozen embeddings. (3) We provide a systematic benchmarking study against the state-of-the-art pretrained traffic encoders, showing that larger models do not necessarily yield more robust representations for IoT traffic. Using more than 18 million real IoT traffic flows collected across multiple years and deployment environments, we learn traffic representations from unlabeled data and evaluate device-type classification on disjoint labeled subsets, achieving macro F1-scores exceeding 0.9 for device-type classification and demonstrating robustness under cross-environment deployment.

Figures (15)

• Figure 1: Structure of a Custom Flow.
• Figure 2: Architecture of our auto-encoder.
• Figure 3: Mean squared error (MSE) of reconstruction on the validation set as a function of training epochs for different autoencoder configurations. Each subplot corresponds to a distinct encoder depth $\mathbf{n}$, while colored curves within each subplot represent different latent dimensions $\mathbf{i} \in \{10, 20, 40, 80\}$.
• Figure 4: MSE of reconstructed numerical features on the validation set.
• Figure 5: Reconstruction of two randomly selected flows from the validation set $\mathrm{DATA16}_{\text{val}}$: (a) a sample TCP flow and (b) a sample UDP flow, showing raw and normalized feature values alongside their reconstructed counterparts.