# Dual-IoTID: A Session-Based Dual IoT Device Identification Model
## 2 Related Work  
The increasing number of IoT devices has made it difficult for network managers to monitor the IoT environment. For network managers, it is necessary to be able to identify which IoT devices have been or are attempting to connect to their network and monitor them to protect them from network threats. In recent years, researchers have developed several identification methods for IoT devices. These methods can be primarily categorized into active IoT device identification technology and passive IoT device identification techniques. Active IoT device identification, also known as active probing, involves the identification party actively sending probe messages to IoT devices based on communication protocol formats. It collects and analyzes relevant fields from response data, such as DNS requests, MAC OUI, and the user-agent field in HTTP requests. These fields are then matched with identification rules, which are either manually crafted or generated automatically. If a substring from the application layer response data matches a rule, the device is labeled using the information from that rule. Currently, the most popular large-scale active probing platforms are based on manually crafted rule libraries for identification, such as Censys, Shodan, and Zoomeye. However, a manual rule annotation is overly cumbersome and demands annotators with strong professional knowledge. Moreover, with an increasing number of protocols and device types, maintaining and updating large rule libraries becomes increasingly difficult. Therefore, scholars have attempted to create automated rule generation. [PERSON] et al. proposed ARE (Acquisitional Rule-Based Engine) [16], which can automatically generate identification rules. ARE actively sends probe data to IoT devices and extracts relevant fields from the response data. It then uses these fields as search query keywords in search engines. Subsequently, ARE crawls websites from the search result list. For relevant webpages, ARE employs Named Entity Recognition (NER) to extract device annotations, including the device type, vendor, and product. However, ARE has some limitations, such as the inability to perform search queries if there is no device-related information in the response data. To identify IoT devices that ARE cannot recognize, [PERSON] et al. proposed IoT tracker [17]. In the feature extraction stage, IoTtracker divides application layer data into semi-structured and unstructured data and then extracts the structure or features of each category. During the device identification stage, a labeled device database is required, and the similarity between the features of unknown devices and known devices is calculated. If the similarity exceeds a certain threshold, the label of the known device can be used to label the unknown device. The number of devices that this method can identify depends on the completeness of the label dataset. Active IoT device identification, under the condition of allowing access to device information, can obtain more granular details such as the device type, vendor, and model. However, it has limitations when device ports are not open to external access or when third-party information collection is not permitted. In such cases, device information cannot be obtained, thus restricting the effectiveness of this method. Passive IoT device identification is to identify IoT devices connected to the network by monitoring network traffic and analyzing device communication behavior. This method does not actively intervene in the network but passively observes the communication activities of the device to achieve device identification. In [18], the authors proposed a fingerprint-based identification framework called IoTsense. It generates device fingerprints based on network activities, protocol features, payload features, and other aspects of the first five data packets from the IoT device and then identifies the device type. Their fingerprint identification method provides an overview of the behavioral profile of device types.