## 3 CSCL-WVE-UDI: Method for Identifying Unknown IoT Devices
### WVE-UDI:UDI Algorithm Based on WVE
#### 3.5.5 WVE-UDI Algorithm  
Based on the process above, we propose the WVE-UDI algorithm. The pseudocode for the WVE-UDI algorithm is described in Algorithm 5. The inputs include new traffic data \(X_{u}\) (which contains traffic data from unknown IoT devices), the embedded vector database \(ED\) of known IoT devices, the trained and saved CSCL-Siamese network model \(M\), and a preset similarity threshold \(\theta\). The output is the identification result of the unknown IoT devices \(\hat{Y}_{u}\). ```
0:\(X_{u}\);\(ED\);\(M;\theta\)
0:\(\hat{Y}_{u}\) // Unknown IoT device identification results
1:for each \(x_{u}\) in \(X_{u}\)do
2:\(NS\leftarrow\) call Data Preprocess(\(x_{u}\)) // Call Algorithm 1 to perform data preprocessing on new traffic data
3:endfor
4:for each \(ns\) in \(NS\)do
5:\(h_{ns}\leftarrow\) call improved-Nilsimsa(\(x_{u}\)) // Call Algorithm 2 to generate a 512-bit hexadecimal hash value
6:\(g_{ns}\gets h_{ns}\) use Pillow // Generating grayscale images with the Pillow library
7:\(G_{ns}\gets g_{ns}\) // Get a sample set of grayscale images
8:endfor
9:\(NED\gets M(G_{ns})\) // Get all embedding vectors for new traffic data
10:for each \(ned\) in \(NED\)do
11:for each \(ed\) in \(NED\)do
12:for each \(ed\) in \(ED\)do
13:\(d_{\min}\leftarrow\) Use Equation (8) to calculate and find out minimum // Calculate the minimum similarity distance using Equation (8)
13:if\(d_{\min}<\theta\)then // Comparison of Similarity Thresholds
14:\(UED\gets ned\) // Save filtered embedding vectors for all unknown IoT devices
15:endifUnknowin IoT Device Identification Models and Algorithms based on CSCL-Siamese Networks and Weighted-Voting Clustering Ensemble
16:endfor
17:endfor
18:\(A\gets Agglomerative(UED)\) // Agglomerative identification results
19:\(B\gets Birch(UED)\) // Birch Recognition Results
20:\(G\gets GaussianMixture(UED)\) // GaussianMixture Recognition Results
21:\(W_{A}\gets 0.2;W_{B}\gets 0.2;W_{G}\gets 0.6\) // Assignment of weights
22:for each \(a_{ik_{n}}\) in \(\mathbf{a}\)do
23:for each \(b_{ik_{n}}\) in \(\mathbf{B}\)do
24:for each \(\hat{g}_{ik_{n}}\) in \(G\)do
25:\(labels\_weight\leftarrow\max(W_{A}\cdot a_{ik_{n}};W_{B}\cdot b_{ik_{n}};W_{G} \cdot\hat{g}_{ik_{n}})\)
26:if\(len(labels\_weight)\
eq 1\)then // Label conflicts after weighting
27:\(k\gets g_{ik_{n}}\)
28:else\(labels\_weight\)
29:endif
30:\(\hat{Y}_{u}\gets k\) // Final identification results
31:endfor
32:endfor
33:endfor
34:\(\hat{Y}_{u}\)
```  
**Algorithm 7** WVE-UDI algorithm The computational overhead of Algorithm 5 primarily originates from the grayscale image fingerprint-sample generation, the embedding-vector filtering of unknown IoT devices, and the clustering-ensemble identification. The generation of grayscale-image fingerprint samples involves cleaning the data sample set and converting each sample into a grayscale image, which results in a time complexity of \(O(n)\). The embedding-vector filtering of unknown IoT devices requires iterating through each embedding vector and comparing its similarity distance with the embedded vector database of known IoT devices, which results in a time complexity of \(O\big{(}n^{2}\big{)}\). The clustering-ensemble identification requires integrating the clustering results of the three clustering algorithms, with a time complexity of \(O\big{(}n^{3}\big{)}\). Thus, the total time complexity of Algorithm 5 mainly results from the three clustering algorithms. By integrating Algorithms 1-5, we propose the CSCL-WVE-UDI method (unknown IoT device identification method based on CSCL-Siamese networks and WVE). The workflow of the CSCL-WVE-UDI method is as follows: First, Algorithm 1 is called to preprocess the raw traffic data \(X_{row}\) of known IoT devices, thus resulting in payload data \(S\). Subsequently, Algorithms 2 and 3, specifically the improved Nilsimsa and PNSP algorithms, are invoked to transform the payload data \(S\) into PNSP's \(Po\) and \(Ne\).