## 3 CSCL-WVE-UDI: Method for Identifying Unknown IoT Devices
### Algorithm for Generating Permutation Positive-Negative Sample Pairs (PNSPs)
#### 3.3.1 Construction of Device Fingerprints Based on Grayscale Images  
To further reveal the inherent patterns and characteristics of the preprocessed payload data, the preprocessed payload data are transformed into expressive grayscale images, which are used as IoT device fingerprints. The specific steps are as follows: First, the Nilsimsa algorithm [12] has a mathematical property that generates similar hash values for similar content, which allows one to distinguish different IoT devices. However, the classic Nilsimsa algorithm [12] generates relatively small hash values. Consequently, significant details vanish during the hash image-conversion process, thus reducing the distinguishability of the preprocessed payload data. Therefore, a sliding window is introduced, and the idea of generating mixed integers through shift operations from the executable and linkable-format hash function is incorporated [13] to improve the Nilsimsa algorithm. Subsequently, the length of the locally sensitive hash values produced by the improved algorithm is extended to 512 bits. This ensures that the subsequent grayscale images retain the detailed features of the payload data more accurately. Next, the data visualization technique is introduced. The 512-bit hexadecimal hash value is mapped to a grayscale image using the Pillow library (10.0.1). In this mapping, 0 \(\times\) 00 corresponds to black, 0 \(\times\) FF corresponds to white, and each pixel represents two hexadecimal digits. The pixels are arranged sequentially from left to right, thereby forming a 1 \(\times\) 64-sized grayscale image in JPG format. These grayscale images collectively constitute the fingerprint sample set of IoT devices. The improvement strategy for the Nilsimsa algorithm is illustrated in Figure 3.  
The improvement process can be summarized as follows:  
1. A sliding window \(W_{0}\) of size 5 with a step size of 1 is applied to the preprocessed payload data sample \(s_{i}\) and slid to the right. Each window generates multiple triplets, denoted as \(t_{1},t_{2},\ldots,t_{z}\), and each triplet is processed by the tran53 function to compute a value, denoted as \(index\). 2. A 512-length accumulator \(acc\) is defined. The \(index\) value is used to indicate the index position of the accumulator. Each time an \(index\) value is computed, the corresponding index position in the accumulator is incremented by 1. The sliding window shifts sequentially, and all accumulated values are stored in \(acc\). 3. Two sliding windows, each with a size of 16 and a step size of 16, are defined to generate more accumulated values. The initial positions of the first and second windows are set to 0 and 8, respectively. The values in the first and second windows are summed, which are denoted as \(w\) and \(v\), respectively. Since the length of \(acc\) is 512, each window must slide 32 times. 4. The accumulated values from the sliding window are processed via shift operations. First, the lower 8 bits of \(w\) are XORed with the upper 8 bits of \(n_{1}\) to obtain \(n_{1}\), as shown in Equation (1). Subsequently, the upper 8 bits of \(w\) are XORed with the lower 8 bits of \(v\) to obtain \(n_{2}\), as shown in Equation (2). The final values are constrained to the range of 0-255 by applying a bitwise AND with 255, thus ensuring they are suitable for subsequent conversion into fixed-length hexadecimal hash values. \[n_{1}=(w\wedge 255)\oplus((v\gg 8)\wedge 255) \tag{1}\]  
\[n_{2}=((w\gg 8)\wedge 255)\oplus(v\wedge 255) \tag{2}\]  
The sliding window continues to shift to the right across \(acc\), thus ultimately producing a 512-bit hexadecimal locally sensitive hash value. Based on the improvements above, we propose an improved Nilsimsa algorithm. The pseudocode of this algorithm is presented in Algorithm 2. The input is the preprocessed payload sample \(s_{i}=(s_{i}^{1},s_{i}^{2},\ldots,s_{i}^{m})\) of the \(i\)-th type IoT device, and the output is the 512-bit hexadecimal hash value \(h_{s_{i}^{j}}\) of the payload sample.