Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling

• URL: http://arxiv.org/abs/2608.15465v2
• Date: Mon, 24 Aug 2026 00:37:44 GMT
• Title: Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling
• Abstract summary: We study how behavioral evolution manifests across device classes and how retraining with newly labeled traffic restores classification performance.<n>We develop a conformity-based drift detector that captures class-conditional behavioral models directly from raw traffic features.<n>We demonstrate that adjusting the traffic labeling rate according to the observed behavioral evolution, combined with uniform traffic sampling, maintains performance more effectively than detector-guided sample selection.
• Score: 2.2049294671639834
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Identification of IoT device types from passive traffic is increasingly used for security management in enterprise and ISP networks. However, the performance of machine learning-based classifiers gradually degrades under concept drift as device behavior evolves. Therefore, maintaining classification performance requires periodic retraining with newly labeled deployment traffic. The operational challenge is determining how much and which deployment traffic instances to label for maintaining classification performance. We show that these two decisions should be treated separately. While retraining solely on instances selected by a drift detector is prone to systematically overlooking parts of the emerging behavioral space, uniformly sampled deployment traffic captures more representative behavioral changes. Instead, drift detection is more effective at determining the amount of deployment traffic that should be labeled. We make three contributions. (1) We conduct a two-year longitudinal study of IoT traffic and characterize how behavioral evolution manifests across device classes and how retraining with newly labeled traffic restores classification performance. (2) We develop a conformity-based drift detector that captures class-conditional behavioral models directly from raw traffic features and provides feature-level explanations of behavioral evolution. (3) We demonstrate that adjusting the traffic labeling rate according to the observed behavioral evolution, combined with uniform traffic sampling, maintains classifier performance more effectively than detector-guided sample selection and is beneficial to managing the traffic labeling effort. We further show that this strategy performs comparably to confidence-guided adaptation while providing feature-level explanations. Our evaluation uses 3.8 million IPFIX flow records collected from 21 IoT types over more than 2 years.

Related papers

• TDDM-Melatt: A Decoupled Memory and Diffusion Framework for Generalizable Encrypted Traffic Classification [8.96087505726163]
  We propose a disentangled memory-based traffic classification framework with diffusion-based data augmentation.<n>We design Melatt, a memory-decoupled traffic representation model, which employs Competitive Gating Long Short-Term Memory (CG-LSTM) to construct the encoder and decoder.<n>Under strict flow-level splitting and anonymization, TDDM-Melatt outperforms 6 basic classification models and 6 SOTA representation learning models.
  arXiv  Detail & Related papers  (2026-08-31T13:11:52Z)
• SIREN-Bench: Behavior-Driven Generation and Evaluation of Emergency-Vehicle Interactions [4.523530339704703]
  We present textbfSIREN, a behavior-driven SUMO--CARLA co-language platform for generating EMVsimulation--civilian interactions.<n>We instantiate the platform as textbfSIREN-v1, comprising seven parameterized interaction templates across emergency levels L1--L3 and three behavior families.<n>We demonstrate the benchmark through three representative tasks: 3D object detection, trajectory prediction, and vision-language risk understanding.
  arXiv  Detail & Related papers  (2026-08-25T05:41:34Z)
• UAV traffic scene understanding: A regulation embedded multi-modal network and a unified benchmark [22.241798167957214]
  Traffic scene understanding from unmanned aerial vehicle (UAV) platforms is crucial for intelligent transportation systems.<n>Existing methods face significant challenges in real-world surveillance, as their heavy reliance on optical imagery leads to severe performance degradation.<n>We propose a novel Multi-modal Traffic Cognition Network (MTCNet) for robust UAV traffic scene understanding.
  arXiv  Detail & Related papers  (2026-03-11T12:53:38Z)
• Generalizable IoT Traffic Representations for Cross-Network Device Identification [15.867734233278568]
  We study the problem of learning generalizable traffic representations for IoT device identification.<n>We design compact encoder architectures that learn per-flow embeddings from unlabeled IoT traffic.<n>We show that these learned representations can be used effectively for IoT device-type classification.
  arXiv  Detail & Related papers  (2026-01-27T07:56:31Z)
• Building Transparency in Deep Learning-Powered Network Traffic Classification: A Traffic-Explainer Framework [2.289837306672451]
  We propose Traffic-Explainer, a model-agnostic and input-perturbation-based traffic explanation framework.<n>By maximizing the mutual information between predictions on original traffic sequences, Traffic-Explainer uncovers the most influential features driving model predictions.<n>Experiments demonstrate that Traffic-Explainer improves upon existing explanation methods by approximately 42%.
  arXiv  Detail & Related papers  (2025-09-22T16:46:12Z)
• Overtake Detection in Trucks Using CAN Bus Signals: A Comparative Study of Machine Learning Methods [51.28632782308621]
  We focus on overtake detection using Controller Area Network (CAN) bus data collected from five in-service trucks provided by the Volvo Group.<n>We evaluate three common classifiers for vehicle manoeuvre detection, Artificial Neural Networks (ANN), Random Forest (RF), and Support Vector Machines (SVM)<n>Our pertruck analysis also reveals that classification accuracy, especially for overtakes, depends on the amount of training data per vehicle.
  arXiv  Detail & Related papers  (2025-07-01T09:20:41Z)
• Unsupervised Domain Adaptation for Self-Driving from Past Traversal Features [69.47588461101925]
  We propose a method to adapt 3D object detectors to new driving environments. Our approach enhances LiDAR-based detection models using spatial quantized historical features. Experiments on real-world datasets demonstrate significant improvements.
  arXiv  Detail & Related papers  (2023-09-21T15:00:31Z)
• Unsupervised 3D registration through optimization-guided cyclical self-training [71.75057371518093]
  State-of-the-art deep learning-based registration methods employ three different learning strategies. We propose a novel self-supervised learning paradigm for unsupervised registration, relying on self-training. We evaluate the method for abdomen and lung registration, consistently surpassing metric-based supervision and outperforming diverse state-of-the-art competitors.
  arXiv  Detail & Related papers  (2023-06-29T14:54:10Z)
• Activation to Saliency: Forming High-Quality Labels for Unsupervised Salient Object Detection [54.92703325989853]
  We propose a two-stage Activation-to-Saliency (A2S) framework that effectively generates high-quality saliency cues. No human annotations are involved in our framework during the whole training process. Our framework reports significant performance compared with existing USOD methods.
  arXiv  Detail & Related papers  (2021-12-07T11:54:06Z)
• A Driving Behavior Recognition Model with Bi-LSTM and Multi-Scale CNN [59.57221522897815]
  We propose a neural network model based on trajectories information for driving behavior recognition. We evaluate the proposed model on the public BLVD dataset, achieving a satisfying performance.
  arXiv  Detail & Related papers  (2021-03-01T06:47:29Z)
• IntentNet: Learning to Predict Intention from Raw Sensor Data [86.74403297781039]
  In this paper, we develop a one-stage detector and forecaster that exploits both 3D point clouds produced by a LiDAR sensor as well as dynamic maps of the environment. Our multi-task model achieves better accuracy than the respective separate modules while saving computation, which is critical to reducing reaction time in self-driving applications.
  arXiv  Detail & Related papers  (2021-01-20T00:31:52Z)
• Quantifying the Impact of Non-Stationarity in Reinforcement Learning-Based Traffic Signal Control [7.970144204429356]
  We analyze the effects that different sources of non-stationarity have in a network of traffic signals. We show that the lack of suitable sensors to provide a representative observation of the real state seems to affect the performance more drastically than the changes to the underlying traffic patterns.
  arXiv  Detail & Related papers  (2020-04-09T19:20:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.