ML-Driven Device Identification

• Device identification using machine learning is a process that distinguishes individual devices by extracting unique network and physical-layer features.
• Techniques include network traffic fingerprinting, RF and physical layer analysis, and hybrid pipelines to overcome spoofing and enable robust security.
• Models range from decision trees to deep neural networks and employ adaptive retraining and feature selection to maintain accuracy in dynamic environments.

Device identification using machine learning is the process of distinguishing individual devices (IoT, wireless, or audio/recording devices) or classes of devices based on measurable features collected from passive observations. These features may be derived from packet-level traffic, flow/session statistics, or physical-layer wireless/radio characteristics (RF fingerprints). Accurate device identification underpins network security, monitoring, automated inventory management, and anomaly detection, especially in settings where explicit identifiers (MAC, IP) are untrustworthy due to spoofing or randomization. Machine learning enables robust extraction of device-intrinsic patterns, adaptive to dynamic environments and capable of generalizing across diverse scenarios.

1. Identification Approaches and System Taxonomy

Device identification schemes are categorized by feature source and identification granularity. The most common paradigms are:

• Network-Level Behavioral Fingerprinting: These methods rely on packet- or flow-level features, including statistical descriptors of packet sizes, inter-arrival times, protocol flags, flow durations, and derived aggregates. Identifiers may be constructed from single packets, sliding windows, or full flows, and are agnostic to the packet payload, supporting operation on encrypted traffic (Chowdhury et al., 2024, Chowdhury et al., 2022, Kostas et al., 2021, Mainuddin et al., 2022). Class-based models (type, functional class) and unique identification (per-device) are both supported, but the former generalizes better outside lab conditions (Kostas et al., 28 Jan 2026, Kostas et al., 2024).
• Wireless and Physical Layer Fingerprinting: Techniques in this class extract device-specific features from the electromagnetic waveform transmitted by each device. This includes IQ-imbalance parameters, transient burst signatures, channel state information (CSI), received signal strength, and advanced transformations (e.g., wavelet or chirplet time-frequency analysis) (Huang et al., 2023, Šobot et al., 2022, Youssef et al., 2017, Ahmed et al., 20 Jun 2025). Such physical-layer fingerprints are resilient to spoofing and generally independent of higher-layer protocol stack.
• Hybrid and Application-Specific Pipelines: Some domains (e.g., audio recording device forensics) derive features directly from hardware noise signatures using domain-specific transformations (e.g., wavelet denoising followed by spectral histogram computation) (Qi et al., 2016).
• Graph-Based Methods: Device dependency or relationship identification (not direct identity) can be formulated as a link prediction problem on time-aware graphs using constrained random walks and neural node embeddings (Sadlek et al., 2024).

Identification models may be trained for per-device granularity, per-type (make/model), or per-functional-class (e.g., camera, bulb), with the choice dictating feature selection and deployment architecture (Kostas et al., 28 Jan 2026).

2. Feature Engineering and Extraction Strategies

2.1 Network Traffic and Flow Features

Packet-level and flow-level approaches typically involve:

• Feature sets: Numeric vectors derived from IP, TCP, UDP headers, protocol flags, entropy of payload bytes (calculated via $H_i = -\sum_b p_i(b)\log_2 p_i(b)$), statistical moments (mean, variance, skewness, kurtosis) of sizes and inter-arrival times, port number classes, and higher-level protocol indicators (Chowdhury et al., 2022, Kostas et al., 2021).
• Extraction techniques: Employ tools such as Tshark or custom PCAP parsers, extract hundreds to thousands of possible header fields, then select a subset through attribute evaluators (gain ratio, information value, recursive feature elimination, genetic algorithms) (Kostas et al., 2024, Chowdhury et al., 2022).
• MAC/Session Aggregation: After per-packet (or per-flow) device predictions, aggregation by MAC (majority vote or exception-list vote) improves device-level accuracy, especially to counter the transfer device problem (hub-shared MACs) (Kostas et al., 2023, Kostas et al., 2021).

2.2 Wireless and Physical Layer Features

Physical-layer fingerprinting leverages device-specific hardware characteristics:

• IQ imbalance and RF impairments: Extraction of device-unique amplitude and phase errors, expressed as parameters $\alpha$, $\varphi$ in the baseband model. Features are visualized or summarized in density trace plots (DTP), constellations, or time-frequency maps (Huang et al., 2023, Youssef et al., 2017).
• Time-domain transients and energy spectra: General Linear Chirplet Transform (GLCT) maps the turn-on burst to a 900-dimensional feature vector, encoding time–frequency–chirp information (Ahmed et al., 20 Jun 2025).
• Channel State Information (CSI): Per-subcarrier amplitudes or phase differences provide a robust multi-dimensional signature, particularly in static (industrial) deployments (Šobot et al., 2022).
• Statistical moments and transient analysis: Wavelet transforms, self-organizing maps, and time-frequency signatures (e.g., scalogram variance) further compress high-dimensional RF data into discriminative features (Youssef et al., 2017, Ahmed et al., 20 Jun 2025).

3. Machine Learning Models and Training Protocols

Identification models span classical and modern supervised paradigms:

• Classical supervised models: Decision trees (DT, J48), random forests (RF), gradient boosting (XGBoost, LightGBM), support vector machines (SVM), k-nearest neighbors (kNN), and logistic regression are widely used for their interpretability and speed. Model selection is often based on cross-validation F1 score, macro-F1, or balanced accuracy (Mainuddin et al., 2022, Chowdhury et al., 2022, Kostas et al., 2024).
• Deep learning architectures: Multilayer perceptrons (MLP), convolutional neural networks (CNN), LSTM/bidirectional LSTM (biLSTM), RNNs, and transformer-based tabular BERT are employed for their ability to discover discriminative features over large-scale, high-dimensional input data, such as spectrograms or sequences of CSI vectors (Huang et al., 2023, Qi et al., 2016, Ahmed et al., 20 Jun 2025, Šobot et al., 2022). Hybrid models (CNN-Bi-GRU) have demonstrated near-perfect F1 performance on RF burst signatures (Ahmed et al., 20 Jun 2025).
• Edge deployment and retraining: Resource-limited environments prefer lightweight NNs (FC or shallow CNN) over tree ensembles for inference speed and updatability (Kolcun et al., 2020). Partial retraining (layer freezing), nightly or weekly retrain triggers (on accuracy drift), and localized update pipelines sustain model accuracy in the presence of device/traffic drift.
• Evaluation protocols: Stratified k-fold cross-validation, session-wise or environment-wise train/test splits (CV, SS, DD), and domain-shift validation are essential for revealing generalization failures; session-level splits avoid leakage from session-specific artifacts (Kostas et al., 2024, Kostas et al., 28 Jan 2026).

4. Handling Channel and Environment Variability

A major challenge is sustaining identification accuracy under channel fluctuation and cross-site deployment:

• Wireless channel dynamics: Latency-based features are strongly affected by channel utilization and contention. The accumulation score ($\mathcal{A}_j$), capturing fine-grained channel activity weighted by a bell-curve, is jointly incorporated as both a feature and a data-balancing tool, dramatically improving cross-condition accuracy ($>$97% F1, vs. 75% without) (Tushir et al., 2024).
• MIMO and channel equalization: Utilizing MIMO diversity and blind channel estimation (full/partial blind) before downstream classification sharply reduces channel-induced variance, boosting cross-channel classification accuracy by up to 70% relative to SISO pipelines (Hamdaoui et al., 2023).
• Feature generalizability: Genetic-algorithm–based feature selection across datasets and environments yields a packet-header subset that generalizes across major domain shifts (GeMID framework). Flow/session-based statistics are vulnerable to environment/capture-specific bias, causing severe generalization degradation (Kostas et al., 2024).
• Aggregation and outlier handling: Persistent device identity is more robustly inferred by aggregating packet-level decisions (e.g., majority vote per MAC), with additional exception-handling for transfer MACs (shared/hub use) (Kostas et al., 2023).

5. Performance Metrics, Results, and Scalability

Performance is validated using standard multiclass metrics:

Model/Approach	F1/Accuracy (%)	Dataset/Setting
XGBoost (iotID, flow features)	99.8 (BAS)	Smart-home IoT/non-IoT (11 classes) (Mainuddin et al., 2022)
Decision Tree (packet header GA)	93.5 (F1)	Cross-dataset (mixed protocols) (Kostas et al., 2021)
LightGBM (latency+accumulation)	97.1 (F1)	Dynamic Wi-Fi, real channel fluctuation (Tushir et al., 2024)
CNN + DTP (RF/IoT)	96.7 (acc.)	SDR 5-class RF (wired) (Huang et al., 2023)
CNN-Bi-GRU + GLCT	99.4 (F1)	9 RF devices, burst transients (Ahmed et al., 20 Jun 2025)
GeMID (GA packet header subset)	77.6 (F1, DD)	Multisite, cross-dataset (Kostas et al., 2024)

Classical methods (ensemble trees, weighted loss) are competitive for moderate feature sets and can be tuned for memory/concurrency in edge deployments (Kolcun et al., 2020, Mainuddin et al., 2022). Deep learning models excel with high-dimensional signal or RF data but incur greater compute and memory cost (Youssef et al., 2017, Ahmed et al., 20 Jun 2025). Aggregation and domain-aware feature curation are key for scaling to large, heterogeneous IoT environments.

6. Limitations, Robustness, and Best Practices

Significant limitations and recommendations for robust device identification include:

• Feature leakage and overfitting: Inclusion of explicit or session-specific identifiers (IP/MAC, sequence numbers, checksums) contaminates models, leading to inflated metrics and catastrophic generalization loss. Features must be filtered to include only device-intrinsic or protocol-invariant fields (Kostas et al., 28 Jan 2026, Kostas et al., 2024).
• Drift and retraining: Model drift due to firmware upgrade or environmental change is empirically observed (e.g., $~0.01$ F1/day). Retraining must be scheduled, ideally on local/household traffic for edge deployments (Kolcun et al., 2020).
• Data imbalance: Device and class imbalance is naturally severe (e.g., cameras vs. sensors). Balanced sampling, class-weighted loss, or stratified evaluation are essential (Mainuddin et al., 2022, Kostas et al., 28 Jan 2026).
• Adversarial robustness: Many packet-header and flow-based models have not been validated against active evasion (header randomization, timing jitter). Robustness to adversarial attacks is a critical open problem (Chowdhury et al., 2024).
• Generalization practices: Models should be validated in three contexts: cross-validation within a dataset, session-to-session, and environment-to-environment generalization. Cross-environment and domain-shift validation best reveal true generalizability (Kostas et al., 2024).

7. Outlook and Research Directions

Device identification by machine learning is now mature for lab, static, or controlled environments, but sustaining high accuracy across dynamic, adversarial, and multi-site conditions remains a major challenge. Emerging trends include:

• Integration of physical-layer and behavioral features: Combining RF-specific, hardware-rooted signatures with protocol-level features may yield the best of both worlds—resilience to spoofing with general cross-environment coverage.
• Adaptive retraining and continual learning: Edge-friendly pipelines must support fast retrain, on-line learning, and partial or selective model update to keep up with device and firmware churn (Kolcun et al., 2020, Liu et al., 2021).
• Graph representations and dependencies: Device-dependency or relationship identification is increasingly modeled using graph-embedding and link-prediction, offering new automation for operational risk assessment (Sadlek et al., 2024).
• Open, reproducible pipelines: Robustness to data leakage, feature misuse, and hidden bias demands open-source pipeline components, precise reporting (confusion matrices, per-class metrics), and community benchmarks for head-to-head comparison (Kostas et al., 28 Jan 2026, Kostas et al., 2024).

By rigorously aligning feature selection, model architecture, and evaluation protocol to deployment constraints and environment variability, machine learning–based device identification can deliver accurate, scalable, and robust solutions for IoT security, network management, and automated asset tracking.