# Dual-IoTID: A Session-Based Dual IoT Device Identification Model
## 3 Proposed Method
### System Overview and Methodology
#### 3.1.3 Frequent Item Extraction and Initial Classification  
In this step, the requirement is to extract frequent items from sessions of different IoT devices. Previous studies have attempted to create device fingerprints for IoT device identification from specific application layer protocols (such as HTTP and DNS) [23]; however, this method has latency issues. Consequently, instead of limiting ourselves to certain protocols, our method attempts to extract frequent items from all IoT device sessions to construct their fingerprints. 1. Session Aggregation  
The first step involves aggregation sessions based on the destination port of the IoT device. After investigation, we discovered that for most IoT devices, the ports they connect to on the server side tend to be fixed or closely related, as illustrated in Figure 2. Furthermore, sessions with similar or identical destination ports display a high level of resemblance. Therefore, we attempt to aggregate sessions of IoT devices based on their destination port numbers. We categorize port numbers into the following categories based on their characteristics: 53-DNS, 67-BOOTP server, 68-BOOTP client, 80-HTTP, 123-NTP, 137-NBNS, 554-RISP, 443-HTTPS, 445-SMB,1900-SSDP, 5353-mDNS, 5355-LLMNR, 8080-WWW, 49153-ANTLR, 0:1023-well-known ports, 1023:49151-registered ports, and 49152:65535-dynamic (private) ports [21]. These ports do not have any inclusive relationship; for example, port 80 will not be classified as a well-known port. If the destination port numbers of two sessions belong to the same category, then these two sessions will be aggregated together. However, if the destination port numbers of two sessions are the same but the transport layer protocols are different, they will not be grouped into the same category. 2. Frequent Item Extraction  
Next, we proceed to extract the IoT device's frequent items from the sessions that have been aggregated in step one for the training set. It is important to note that we do not extract frequent items for non-IoT devices at this step. Taking inspiration from the N-gram concept, we devised a method to extract frequent items from the first 40 bytes of the payload in each session. The process is as follows: A sliding window of size N moves across the payload at the byte level, generating a series of byte sequences, each having a length of N. We term each of these byte sequences a \"gram\". Then, we calculate the frequency of occurrence of each gram in each category of sessions, apply a predefined threshold for filtering, and generate the list of frequent patterns for the current IoT device. Finally, we merge all frequent items extracted from the sessions of all IoT devices to compile a word set. The pseudocode is shown in Algorithm 1. ```
1:Input: IoT session files _pcaps_, length \(N\), Threshold _TS_
2:Input: Frequent items _Freq_item_
3:1:\(\mathit{dport\_set}\)\(\leftarrow\)dict0
4:2:for Session in pcaps do
5:\(\mathit{dport}\).set[Session.dport].append(Session)
6:endfor
7:\(\mathit{Freq\_item}\)\(\leftarrow\)set0
8:for\(\mathit{dport}\), session in dport_set do
9:\(\mathit{Freq\_set}\)\(\leftarrow\)dict0
10:for\(\mathit{s}\) in session do
11:for\(\mathit{i}\) in [0:40-\(\mathit{N}\)] do
12:\(\mathit{Freq\_set}\)[\(\mathit{s[i[i+N]]+1}\)]
13:endfor
14:endfor
15:endfor
16:for item_count in F_set do
17:if count/len(session)\(\geq\)TS then
18:\(\mathit{Freq\_item\_add(item)}\)
19:endif
20:endfor
21:return Freq_item
30:
```  
**Algorithm 1**Frequent_Item_Extraction (_pcaps_, \(N\), _TS_)  
Figure 2: Sankey diagram of server port numbers used by different IoT devices. Depicting the top 7 most commonly used ports in TCP and UDP, respectively. **(a)** Withings Smart Baby Monitor. **(b)** Amazon Echo. **(c)** Belkin Wemo Motion Sensor. **(d)** Samsung SmartCam. Next, all sessions need to be transformed into word vectors based on the word set. The length of each vector corresponds to the total number of unique words in the set.