# A Network Device Identification Method Based on Packet Temporal Features and Machine Learning
## 1 Introduction
The recognition results were further modified by selecting the \(F1\) score value as the main evaluation index, and the highest achieved recognition effect was 93%. However, this method does not consider the relationship between packets and is less effective at recognizing similar devices. In addition to the basic features extracted from packets, researchers subsequently added network statistics. [PERSON] et al. [6] used a fingerprint consisting of 67 statistical features extracted from the headers of 20-21 consecutive packets of Ethernet, IP, UDP, and TCP, which were also classified using a traditional machine learning approach, achieving an accuracy of 90.3%. However, the network statistics change with different networks, and the applicability is poor. [PERSON] [7] monitored the network data generated by 28 devices during normal operation and extracted eight features from them. They used a two-stage classification algorithm, with the first step using the Naive Bayes (NB) algorithm and the second step using the RF algorithm, and the final classification of 28 devices reached an accuracy of 99.88%. However, the features were too specific and did not focus on device behavior, which made them less applicable. The development of deep learning has led to its wide application in various fields, and researchers have applied it to extract deeper features of packets, such as temporal and spatial features. [PERSON] et al. [8] used a packet sniffer to collect packets, focusing on the time interval between two consecutively received packets (Inter Arrival Time (IAT)). Due to differences in hardware and devices, the IAT is unique for each device, so each device's IAT graph was plotted and the features were extracted using convolutional neural networks, which, in turn, enabled network device identification. DFP [9] operated by selecting two features based on the characteristics of the device (Window_size and IP_len), extracting the values of 100 consecutive packets, and generating the trajectory image to be used as a fingerprint. Using a convolutional neural network architecture, it was then possible to distinguish between known and unknown traffic, IoT devices and non-IoT devices, and individual devices, achieving 98% accuracy on two publicly available datasets. DPLS [10] involved a method for identifying IoT devices based on sequences of directed packet lengths in network traffic. This method first captured network traffic packets from a device by passively capturing them at a local network gateway, and the length and transmission direction (forward or reverse) of each packet were calculated. The length and direction information were then combined into vectors that were used as inputs for a deep convolutional neural network to identify the unknown device type or model. CBBI [11] involved using spatial and temporal features in the raw network traffic generated by IoT devices, avoiding the cumbersome and inefficient feature extraction of traditional methods and reducing the complexity of the IoT device identification task. The EIEI [12] method involved an end-to-end IoT device identification method (IoT ETEI), which automatically identified IoT devices connected to the network. Instead of extracting features manually, the method directly used the raw network traffic generated by the device and extracted spatial and temporal features through convolutional neural networks (CNNs) and Bi-Directional Long and Short-Term Memory Networks (BiLSTMs) to achieve device identification. Based on the deep learning method, the network traffic data can be processed in a certain way. With the development of deep learning, the fingerprint features of the device can be better extracted and more effectively fused, and better results can be obtained, but this also relies on a large amount of data for training. In this paper, based on the deep learning method, feature extraction was performed on the original packet using feature importance voting, genetic algorithms, etc.