# Dual-IoTID: A Session-Based Dual IoT Device Identification Model
## 1 Introduction  
The Internet of Things (IoT) constitutes a network of interconnected things. The IoT extends and expands based on the Internet, connecting various information sensing devices (RFID, infrared sensors, global positioning systems, etc.) with the Internet through the network for information exchange and communication to achieve intelligent identification, control, perception, monitoring, and management. The IoT has a wide range of application areas, including but not limited to smart homes, smart agriculture, industrial manufacturing, smart transportation, smart cities, healthcare, etc. With the continuous development and improvement of technology, the IoT will play a greater role in the future, promote the intelligent development of society, and create a new era of efficient, convenient, data-driven decision-making. IoT devices will be a significant part of the Internet. As of the beginning of 2024, there are 16.7 billion IoT devices. According to a study, by 2027, there will likely be more than 29 billion IoT connections [1]. With the rapid development of IoT devices, humanity has achieved a more modern and intelligent way of life. In the past few years, the number of IoT devices has experienced explosive growth, significantly exceeding the number of Internet users. However, as the quantity of IoT devices continues to increase, the associated security risks are gradually escalating. Due to its intrinsic characteristics, the IoT confronts heightened risks of cyber threats [2, 3], such as data leakage, broken authentication, and spoofing. In recent years, multiple instances have occurred where IoTdevices were misused for network attacks [4; 5; 6]. As IoT applications extend into more areas while bringing convenience and efficiency, it creates an urgent need for IoT device identification. IoT device identification, as a fundamental technology in network security and defense, plays a crucial role in ensuring the security of the underlying infrastructure. However, the standards for IoT devices are diverse. Even devices of the same type may have differences regarding the control system, transmission protocols, and cipher suite. The environment that applies IoT devices typically deploys a large number of devices, with different types and manufacturers. The inability of administrators to easily identify devices and health behaviors may cause damage to network security and management. According to the special behavior patterns of IoT device communication, researchers usually identify devices by analyzing the characteristics of network traffic, such as communication mode, protocol, and packet size [7]. Traditional methods utilize the information carried by devices during communication, such as using Organizational Unique Identifiers (OUIs) in MAC addresses, TLS certificate manufacturer information, destination IP addresses, DNS requests, and the USER-AGENT field in HTTP requests to identify IoT devices. However, this rule-based identification method is sensitive to potential interference. For example, the user-agent-based identification method cannot be applied to encrypted traffic and has a high delay, so it is not universal [8; 9]. Although MAC OUI is helpful for device identification, the identification granularity is too coarse and cannot be accurately identified [10], making it difficult to meet the identification needs within the local area network. Traditional methods are intuitive and cost-effective, but they often lack accuracy and efficiency, particularly in complex scenarios, and struggle to keep pace with the rapid changes and growing demands of the IoT environment. With the advancement of technologies such as artificial intelligence, machine-learning-based approaches for IoT device identification have emerged in recent years. Unlike traditional methods, machine-learning-based approaches can automatically learn and adapt to complex and dynamic device behaviors, thereby enhancing accuracy and efficiency in identification while also offering stronger dynamic adaptability and scalability.