## 3 CSCL-WVE-UDI: Method for Identifying Unknown IoT Devices
### WVE-UDI:UDI Algorithm Based on WVE
#### 3.5.2 WVE for UDI  
To fully exploit the clustering potential of multiple unsupervised clustering algorithms, we introduce weighting factors to improve the existing voting ensemble strategy [18]. By integrating the clustering results of three different unsupervised clustering algorithms, we aim to achieve clustering-ensemble identification of multiple unknown IoT devices. The main steps are illustrated in Figure 9.  
In the first step, the embedding vectors of unknown IoT devices obtained from the filtering process in Section 3.5.1 are clustered sequentially using agglomerative, BIRCH, and Gaussian mixture algorithms, and their respective clustering results are obtained. Both the agglomerative [19] and Birch [20] algorithms do not require specifying the number of clusters, and the Gaussian mixture algorithm [21] determines the optimal number of clusters using the elbow method. The clustering result of the agglomerative algorithm is \(a_{10},a_{23},\ldots,a_{ik}\), the result of the Birch algorithm is \(b_{10},b_{23},\ldots,b_{ik}\), and the result of the Gaussian mixture algorithm is \(g_{10},g_{21},\ldots,g_{ik}\). Here, \(a_{ik}\) indicates that the \(i\)-th embedding vector of the unknown IoT device is clustered into class \(k\) (i.e., label \(k\)) by the agglomerative algorithm, and so on. In the second step, weights are assigned to the clustering results of each algorithm. The Gaussian mixture algorithm utilizes Gaussian distributions to accurately capture the data distribution and can flexibly reflect the actual structural characteristics of the data [21]. Therefore, it is assigned a higher weight to emphasize its critical contribution to the clustering results. Thus, weight factors of 0.2, 0.2, and 0.6 are assigned to the agglomerative, BIRCH, and Gaussian Mixture algorithms, respectively. In the third step, the clustering labels are integrated. For each sample in the clustering results, the weight of each label is calculated based on the clustering labels obtained from the three individual clustering algorithms and their corresponding weighting factors. For example, if the agglomerative algorithm clusters the \(i\)-th embedding vector of an unknown IoT device into class \(k\), then its weighted value \(w_{a_{ik}}\) is calculated using Equation (9). The label with the highest weighted value is selected as the final integrated label for that sample. During this process, the management of potential label conflicts, where multiple clustering algorithms may assign the same embedding vector to different classes with identical weighted values, is prioritized. For instance, if the agglomerative algorithm clusters the second embedding vector of an unknown IoT device into class 3, the BIRCH algorithm into class 3, and the Gaussian mixture algorithm into class 1, but all weighted values are 0.6, then the Gaus  
Figure 9: Flowchart of weighted-voting clustering integration to identify unknown IoT devices.  
sian mixture algorithm's class is prioritized, i.e., class 1 is selected as the final integrated label. This prioritization is because the Gaussian mixture algorithm was assigned a higher weight in the previous weight assignment, thus indicating its greater significance in the identification results.  
\[w_{a_{ik}}=0.2\cdot a_{ik} \tag{9}\]