## 3 CSCL-WVE-UDI: Method for Identifying Unknown IoT Devices
### Data Preprocessing  
Raw traffic data from IoT devices typically contain noise. In open environments, the format of traffic data sources from IoT devices lacks uniformity, thus rendering it challenging to directly learn traffic features. Therefore, raw traffic data of IoT devices must be preprocessed to ensure data quality and consistency, thus providing a basis for effective feature learning. The data-preprocessing process is detailed in Figure 2. First, as raw traffic data from IoT devices typically exist in pcap and pcappng formats, TShark [9] is used to standardize the raw traffic data in pcappng format to pcap format. Next, to reduce noise and simplify the extraction of traffic features, the raw pcap traffic data are cleaned by removing invalid traffic data, such as packets without payloads or empty packets. Subsequently, the SplitCap tool is employed to segment the cleaned large-scale traffic samples into smaller-scale traffic files based on the five-tuple format (source IP address, destination IP address, source port, destination port, and transport layer protocol) [10], thus generating session data with finer granularity and richer information. Finally, as  
Figure 1: Logical architecture of the CSCL-WVE-UDI approach.  
IoT devices typically have specialized communication protocols and data formats and payload data contain the characteristic information of IoT devices while requiring minimal computational resources and are independent of specific protocols or standards, the Scapy tool (2.6.1) [11] is used to extract the effective payload from the transport layer of all packets within each session.  
Based on the processing steps above, we propose a data-preprocessing algorithm. Its pseudocode is described in Algorithm 1. Let \(x_{i}\) represent the raw traffic sample of the \(i\)-th IoT device. After data preprocessing, the effective payload is denoted as \(s_{i}\leftarrow\left(s_{i}^{1},s_{i}^{2},\ldots,s_{i}^{m}\right)\), where \(m\) represents the number of sessions generated after segmenting the \(i\)-th traffic sample.  
```
0:\(x_{i}\) // Sample raw traffic for the ith IoT device
0:\(s_{i}\leftarrow\left(s_{i}^{1},s_{i}^{2},\ldots,s_{i}^{m}\right)\) // Load data
1:\(pcap_{i}\leftarrow\)TShark(\(x_{i}\)) // standardized format
2:for each \(d_{j}\) in \(pcap_{i}\)do // Cleans each packet in the flow
3:if (\(d_{j}\) is Null) or (\(d_{j}\)) contains no payload then delete \(d_{j}\) from \(pcap_{i}\)
4:endif
5:endfor
6: Utilize SplitCap tool to segment \(pcap_{i}\) into individual sessions, grouped based on identical 5-tuple information, \(y_{1},y_{2},\ldots,y_{m}\)
7:\(s_{i}\leftarrow\left[\right]\)
8:for each \(y_{j}\gets y_{1}\) to \(y_{m}\)do // Indicates the first packet in the current session
9:for each \(t_{k}\leftarrow\)Scapy(\(y_{j}\))do // Indicates the first packet in the current session
10: extract transport layer payloads from \(t_{k}\) and append them to \(s_{i}^{j}\)
11:endfor
12:\(s_{i}\gets s_{i}^{j}\) // Obtain the payload of the ith flow sample
13:endfor
14:return \(s_{i}\)
```  
**Algorithm 1** Data Preprocessing  
The computational overhead of Algorithm 1 primarily arises from traffic cleaning and payload extraction. Traffic cleaning requires iteration through each data packet, thus  
Figure 2: Flowchart of data preprocessing.  
resulting in a time complexity of \(O(n)\). Payload extraction requires iterating through each packet in every session, thus resulting in a time complexity of \(O\big{(}n^{2}\big{)}\). Thus, the total time complexity of Algorithm 1 mainly results from here.