# A Network Device Identification Method Based on Packet Temporal Features and Machine Learning
## 1 Introduction  
With the rapid development of the Internet of Things (IoT) technology, the number of connected devices has grown significantly worldwide. These devices cover a wide range of fields, such as smart home devices, industrial devices, medical devices, and so on, and have greatly improved people's quality of life and the efficiency of their work. According to relevant statistics [1], the number of connected devices worldwide reached 20.35 billion units in 2017, and this number is expected to increase to 75.44 billion units by 2025. With the continuous progress of digital technology, many devices are becoming more intelligent, with correspondingly more stringent requirements on their size and functions. Many devices have defects in their design and configuration which makes them difficult to upgrade and effectively manage. Their lack of security measures also makes them a weak link in network security, and they can be prone to hacking attacks. Attacks are usually associated with specific types and versions of devices. Once an attacker discovers a vulnerability in a device type, they can launch an attack against that type of device. If the device type can be identified before the attack occurs, the impact range and threat level of the vulnerability can be assessed and the source of the attack can be cut off. This effectively avoids the security risk, safeguarding network security [2]. Therefore, network device identification technology is a key technology to solve security problems, and has important research significance. Most traditional network device recognition techniques rely on manually constructing fingerprint libraries to extract device fingerprints from network data. Then, based on matching algorithms, such as regular expressions, the extracted features are matched with the rules in the fingerprint libraries, allowing recognition of network devices. These fingerprint libraries are usually constructed by relying on the a priori knowledge of experts, which can introduce errors and make them complicated to update, affecting the accuracy of device identification. With the rise of artificial intelligence, researchers are increasingly using machine learning techniques for network device identification by extracting features from network data and using a large amount of data to train models. Compared with traditional device identification methods, machine learning can identify various devices in the network more efficiently. Machine learning is usually used to extract features from raw traffic data from communication between devices, which acts as a fingerprint of the device. The fingerprint of the device is then used as input into the machine learning algorithm for network device identification. A fingerprint is a set of features extracted from network data packets to reflect the behavioral patterns of a device. The earliest use of the fingerprinting method was IoT-Sentinel [3], which extracted 23 features from the first 12 packets of each device using network data captured by connected devices at Aalto University, but it was unable to recognize non-IP devices as it performed packet merging from the MAC address. Using traditional machine learning algorithms, 27 devices were finally classified, with an average recognition rate of 95%. IoT-Sense [4] used three payload-related features in addition to 17 protocol features, reflecting the behavior of the devices on top of IoT-Sentinel. On average, every five packets formed a session, and using traditional machine learning, the recall rate of every device reached 93-100%. Although comparisons were made with IoT-Sentinel, the number of devices evaluated was only 10. The IoTDevID [5] method extracted more comprehensive features from the packets, such as more detailed packet static features and multiple dynamic features. Feature selection was carried out using feature importance voting, genetic algorithms, etc. The performance of the traditional machine learning algorithms was compared, and a packet fusion algorithm was proposed.