# Dual-IoTID: A Session-Based Dual IoT Device Identification Model
## 3 Proposed Method
### System Overview and Methodology
#### 3.1.2 Session Communication Feature Extraction  
In this step, we will extract network communication features from the effective payload of sessions. Most session payloads are located at the top layer of the computer network protocol stack--the application layer, which is responsible for handling communication and data exchange between applications. The application layer data of different protocols vary significantly, and different IoT devices use different application layer protocols, exhibiting distinct features. Therefore, we attempt to extract communication features from each session. The extracted features are shown in Table 1, mainly including the following categories:  
1. Message characteristics  
The message refers to the payload of a session, i.e., the actual data transmitted in the communication. Message characteristics mainly include the text-to-binary ratio of the message, the information entropy of the message, and the duration of the session. Text-to-binary ratio: In our definition, text fields consist of continuous printable characters, including numbers, letters, punctuation marks, and standard symbols like spaces and tabs. When there are four or more consecutive characters that qualify as printable characters, that particular byte sequence is categorized as a text field; conversely, if not, it is identified as a binary field. For consistency and efficiency, we perform this calculation on the initial 100 bytes of each flow only. Information entropy: Information Entropy is a quantity in information theory used to measure uncertainty [22]. It is defined as follows:  
\[H(X)=\sum_{i=1}^{n}p(x_{i})\log(p(x_{i})), \tag{1}\]  
where \(p(x_{i})\) represents the probability of random event \(X\) being \(x_{i}\), and the value of entropy is \(0-\log n\). \begin{table}
\begin{tabular}{c c c} \hline \hline
**Type** & **Feature** & **Description** \\ \hline \multirow{6}{*}{Message characteristics} & duration & Total packets in the source direction \\  & src\_entropy & Entropy of first 100 bytes in the source \\  & dst\_entropy & Entropy of first 100 bytes in the destination \\  & src\_bt\_ratio & the text-to-binary ratio in the source \\  & dst\_bt\_ratio & the text-to-binary ratio in the destination \\  & flow\_type & Transport protocol of session (TCP or UDP) \\ \hline \multirow{6}{*}{Counting characteristics} & src\_packet\_cnt & Total packets in the source direction \\  & dst\_packet\_cnt & Total packets in the destination direction \\  & packet\_count & Total packets of bidirectional flows \\  & src\_size & Total bytes from source to destination \\  & dst\_size & Total bytes from destination source \\ \hline \multirow{6}{*}{Counting characteristics} & src\_max\_size & Source–Destination max packet size \\  & src\_min\_size & Source–Destination min packet size \\  & dst\_max\_size & Destination-Source max packet size \\  & dst\_min\_size & Destination-Source min packet size \\  & src\_size\_var & Variance of source packets \\  & src\_size\_mean & Mean size of source packets \\  & dst\_size\_var & Variance of destination packets \\  & dst\_size\_mean & Mean size of destination packets \\  & src\_q1 & One-quarter of source packets \\  & src\_q2 & Median of source packets \\  & src\_q3 & Three-quarters of source packets \\  & dst\_q1 & One-quarter of destination packets \\  & dst\_q2 & Median of destination packets \\  & dst\_q3 & Three-quarters of destination packets \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Features description. Our goal is to identify IoT devices based on the session's payload. Therefore, we calculate the entropy of source and destination flows. As with the text-to-binary ratio, when determining the entropy of the payload, we limit our analysis to the first 100 bytes as well. If a session has no payload, its entropy value is assigned as 0. 2. Counting characteristics  
These are attributes that can be derived through simple counting. They primarily encompass the number of packets, the overall session length, etc.