Semantic Matching of Behavioral Primitives for MUD-Based IoT Device Identification

arXiv:2606.12793 · cs.CR, cs.IR · Submitted 2026-06-11 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia, and with me are Elias and Priya, guest researcher.

Elias: Today's paper: "Semantic Matching of Behavioral Primitives for MUD-Based IoT Device Identification".

Nadia: Accurate identification of Internet of Things (IoT) devices is crucial for security and policy enforcement, especially as runtime communication patterns evolve over time.

Elias: First, who's behind it and why it matters.

Paper summary: Nadia: So, we’re diving into the paper "Semantic Matching of Behavioral Primitives for MUD-Based IoT Device Identification," and it seems the central thesis is that we can identify IoT devices by looking at their communication policies described in Manufacturer Usage Description profiles. What exactly does this mean for how we secure these networks?

Elias: It suggests moving beyond just exact packet overlaps, which can be tricky when runtime behavior shifts, toward a more semantic understanding of the device's policy structure. The paper claims that using Manufacturer Usage Description (MUD) profiles, which describe behavior via Access Control Entries or ACEs—specifying protocol, endpoint, direction, and port semantics—allows us to create robust identification signatures.

Priya: From a privacy and measurement standpoint, I'm curious what the actual data shows; does this method offer any inherent privacy benefits over traditional flow records? We need to see if these semantic representations leak sensitive operational details.

Nadia: That’s a fair question, Priya; the paper focuses on how well these ACE-level semantic representations separate device behavior in the embedding space. The core claim is that we can compress those raw MUD JSON files into compact behavioral text and use models like BGE-M3 to generate one thousand twenty-four-dimensional embeddings from them.

Elias: I see why they focused on compactness; reducing the whole-profile token count from four thousand eight hundred fifty-two down to nine hundred thirty-three is a significant compression, which makes the semantic matching process much more feasible computationally. They also found that these ACE-level embeddings preserve device-level behavioral distinctions more effectively than using whole-profile MUD embeddings.

Priya: That's interesting because if they can capture those distinctions robustly even with compressed text, it suggests the underlying policy structure is a very strong identifier, regardless of minor textual variations. Does this mean we could potentially monitor IoT traffic much more efficiently in real-time?

Nadia: Exactly; the paper shows that when you compare embeddings across three granularity levels—raw JSON, compact ACE text, and individual ACE embeddings—the compact text actually improves inter-device separation to a mean pairwise cosine of zero point eight six five compared to the raw JSON’s zero point nine three six.

Elias: That difference in cosine similarity is telling; it indicates that the semantic representation derived from compact ACE text carries more distinguishing behavioral information than just looking at the full profile data structure, which makes sense because it isolates those policy-level abstractions.

Priya: So if we look at the actual data, what does this imply about identifying devices when their software versions or runtime activity change? The authors noted that firmware updates and user interactions can alter fine-grained traffic patterns even when high-level behavior stays the same.

Nadia: That’s where the paper gets really practical; they test identification under conditions where exact ACE overlap is intentionally removed or degraded, specifically testing unseen ACEs, lexical endpoint drift, and mixed partial observation.

Paper summary: Elias: The matching methods they compared were exact ACE matching versus aggregated semantic matching using mean-pooling whitened ACE embeddings, and then the direct ACE-level semantic matching using an asymmetric MaxSim formulation. That’s where the cryptographic assumptions of the underlying embedding models come into play.

Priya: I'm looking at what they found in those stress tests; specifically, how much identification evidence remains when exact overlap becomes sparse or disappears in real IoT traffic traces composed of over eight hundred thousand observed flows.

Nadia: The results showed that semantic ACE matching provides stronger identification evidence during the early stages of observation because it frequently retains the correct device among the highest-ranked candidates even under sparse-overlap runtime traffic.

Elias: That’s a key finding because it shows that we don't have to rely on perfect, exact overlaps for identification to be useful; semantic similarity can still provide a reliable signal when the communication patterns drift away from the canonical device profile.

Priya: It sounds like the implication here is that this method is not just theoretical; it suggests a practical way to maintain monitoring effectiveness even when devices are actively trying to obfuscate their traffic signatures.

Nadia: Precisely, and that leads us into the conclusions where they discuss the title and authors of "Semantic Matching of Behavioral Primitives for MUD-Based IoT Device Identification." They emphasize that this approach complements exact overlap matching by providing useful evidence for identification under sparse-overlap conditions.

Elias: The implication is that security enforcement systems can use this semantic layer to identify devices earlier in the observation window, even when the traffic isn't perfectly matching a known signature. It’s about using policy structure as a durable identifier rather than just relying on ephemeral packet data.

Priya: From my perspective, this offers a way to measure behavioral variability more meaningfully; instead of seeing noise when an exact match fails, we get structured evidence from the ACE embeddings that shows *how* the behavior is evolving.

Nadia: So, in simple terms for our listeners, "Semantic Matching of Behavioral Primitives for MUD-Based IoT Device Identification" means we’re using a smarter way to recognize devices based on their communication rules rather than just looking for identical traffic patterns.

Elias: It means that even if the device changes how it talks slightly over time, its fundamental policy structure remains detectable through these semantic vectors. It shifts the focus from the exact byte sequence to the underlying intent of the communication protocol usage.

Priya: I think this is important because it suggests a new way to approach IoT profiling that isn't overly reliant on perfect historical data, which could improve how we audit and secure large-scale IoT deployments.

Nadia: It does suggest a path forward where identification becomes more resilient to the inevitable changes in runtime behavior that every deployed device undergoes.

Conclusion: Nadia: So we’ve looked at how they use semantic representations derived from Manufacturer Usage Description profiles to identify IoT devices, and now we need to talk about what that title actually means for us as a security community.

Elias: I think the core idea is moving away from just matching exact data points and toward understanding the actual communication intent captured in those ACEs.

Priya: From my side, I’m thinking about how much real-world noise this semantic approach can handle when we’re trying to track devices across a massive network.

Nadia: Exactly; the paper argues that this semantic matching complements exact overlap matching when runtime behavior starts to deviate from what we initially expect.

Elias: That deviation is where I get interested, because if the underlying policy structure is preserved semantically, it suggests a level of resilience against minor, unpredictable changes in device behavior.

Priya: And that’s what worries me from a measurement standpoint; if the embeddings are robust enough to handle drift and partial observation, it means we might be able to maintain identification accuracy even when the traffic isn't perfectly canonical.

Nadia: That’s right; their conclusion is that this method offers a more resilient way to track devices in real-time observations, even as their communication patterns evolve.

Elias: I think the authors are pointing toward a future where device identification isn't just about matching static fingerprints but about recognizing the dynamic structure of those communication rules.

Priya: That points toward a massive potential impact on IoT security monitoring; if we can reliably track devices through runtime variations, it makes continuous auditing much more feasible for large deployments.

Nadia: It really does, and that leads us to asking who can actually exploit this; I want to know if an adversary could easily mimic these semantic profiles.

Elias: That’s a crucial question; I'd need to examine the assumptions in their embedding models to see where the cryptographic or mathematical weaknesses might lie for someone trying to forge these vectors.

Priya: And on the data front, we need those detailed results showing exactly how much accuracy is retained when we introduce that sparse-overlap condition they tested so thoroughly.

Nadia: That’s what I want to hear; a clear picture of the practical effectiveness under real-world stress tests, not just theoretical improvements in cosine similarity scores.

Elias: I think the implication for cryptography is that if the semantic representation is highly compact and effective, it might actually make signature generation or fingerprinting more efficient overall.

Priya: And for us in privacy research, it means we can better analyze communication patterns without needing to store every single raw flow detail, which is a huge win for data minimization principles.

SAMUEL WITT, HASSAN HABIBI GHARAKHEILI

School of EE&T, UNSW Sydney

cs.CR, cs.IR

Submitted: 2026-06-11

Updated: 2026-09-26

Comments: 14 pages, 4 figures, 5 tables

Code: https://github.com/gonzow9/Semantic-IoT-Behavior

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 89/100

The gist: Accurate identification of Internet of Things (IoT) devices is crucial for security and policy enforcement, especially as runtime communication patterns evolve over time.

Key concepts

Manufacturer Usage Description (MUD): MUD profiles describe how an IoT device communicates by detailing its Access Control Entries (ACEs). Each ACE specifies the protocol, endpoint, direction, and port semantics. These rules define the device's typical communication behavior.
ACE-level Semantic Representation: This method converts complex MUD ACEs into compact behavioral text and uses semantic encoders like BGE-M3 to create high-dimensional embedding vectors. This process compresses the data while preserving the essential meaning, allowing for better comparison of device behaviors.
Semantic ACE Matching: Instead of relying solely on exact matches between communication rules, this technique uses embeddings to find behavioral similarities. It is particularly effective when runtime behavior changes slightly from the original profile, offering robust identification even under sparse overlap conditions.

Terminology

Embeddings — 60× in this paper · explained in 2 episodes
Trace — 33× in this paper · explained in 2 episodes
Accuracy — 20× in this paper · explained in 1 episode
Nadia — 13× in this paper · explained in 2 episodes
Elias — 12× in this paper · explained in 2 episodes
Manufacturer Usage Description — 11× in this paper
Abstraction — 7× in this paper · explained in 1 episode
Fingerprinting — 7× in this paper · explained in 2 episodes
ACE-level Semantic Representation — 6× in this paper · explained in 1 episode
Internet of Things — 5× in this paper
Semantic Similarity — 5× in this paper · explained in 2 episodes
Calibration — 4× in this paper · explained in 7 episodes
Cosine Similarity — 4× in this paper · explained in 3 episodes
Transformer — 4× in this paper · explained in 2 episodes
Verification — 4× in this paper · explained in 2 episodes
Core — 3× in this paper · explained in 2 episodes
Aggregation — 2× in this paper · explained in 1 episode
Anisotropy — 2× in this paper · explained in 3 episodes
Clustering — 2× in this paper · explained in 2 episodes
Concept Drift — 1× in this paper · explained in 4 episodes
Distillation — 1× in this paper · explained in 2 episodes
Distribution Shift — 1× in this paper · explained in 6 episodes
Foundation Model — 1× in this paper · explained in 3 episodes
Foundation Models — 1× in this paper · explained in 7 episodes
Generative AI — 1× in this paper · explained in 2 episodes
Knowledge Distillation — 1× in this paper · explained in 11 episodes
Representation Learning — 1× in this paper · explained in 2 episodes
Semantic Understanding — 1× in this paper · explained in 2 episodes
Tokenization — 1× in this paper · explained in 2 episodes

Summary

Accurate identification of Internet of Things (IoT) devices is crucial for security and policy enforcement, especially as runtime communication patterns evolve over time. This research investigates device identification using Manufacturer Usage Description (MUD) profiles by studying the semantic identification of IoT devices from behavioral primitives.

The gist: Semantic ACE matching can complement exact overlap matching when runtime behavior deviates from canonical device profiles.

ACE-Level Semantic Representation

The study utilizes Manufacturer Usage Description (MUD) profiles, which describe device communication behavior using Access Control Entries (ACEs), where each ACE specifies protocol, endpoint, direction, and port semantics. The authors construct ACE-level semantic representations from compact behavioral text by converting ACEs into behavioral text and using semantic encoders like BGE-M3 to generate 1024-dimensional embedding vectors. This approach addresses the token overhead of raw MUD JSON files by compacting ACEs, reducing the average whole-profile token count from 4,852 to 933 (an 83% reduction). The analysis shows that ACE-level embeddings preserve device-level behavioral distinctions more effectively than whole-profile MUD embeddings.

Embedding Geometry and Whitening

The researchers analyze the intrinsic geometry of BGE-M3 embeddings across three granularity levels: (i) raw whole-file JSON, (ii) compact whole-file ACE text, and (iii) individual ACE embeddings. They find that while raw JSON representations are highly concentrated with a mean pairwise cosine of 0.936, compact ACE text improves inter-device separation to a mean pairwise cosine of 0.865. Furthermore, Per-ACE embeddings preserve substantially greater behavioral variability, with the effective rank increasing from 24.2 for compact whole-file embeddings to 197.6 for ACE-level embeddings. To reduce this concentration, they apply whitening decorrelation, which reduces cosine concentration and increases effective rank across all representations, acting as a cosine calibration without adding behavioral information.

Semantic Identification Under Evolving Runtime Behavior

The paper evaluates identification under controlled runtime variations where exact ACE overlap is intentionally removed or degraded. They test three conditions: (1) unseen ACEs, (2) lexical endpoint drift, and (3) mixed partial observation. The retrieval methods compared are:

Exact ACE matching: Uses Jaccard similarity or exact ACE hit count.
Aggregated semantic matching: Constructs device-level signatures by mean-pooling whitened ACE embeddings.
ACE-level semantic matching: Preserves individual ACE embeddings and performs matching directly at the ACE level using an asymmetric MaxSim formulation, which preserves individual communication behaviors and avoids the information loss introduced by aggregation.

Evaluation on Real IoT Traffic Traces

The final evaluation is conducted on real IoT traffic traces comprising over 800,000 observed flows. These runtime flows are converted into ACE-like behavioral primitives and progressively accumulated. The results show that semantic ACE matching provides stronger identification evidence during the early stages of observation, frequently retaining the correct device among the highest-ranked candidates, and remains effective under sparse-overlap runtime traffic. Specifically, MaxSim outperforms exact hit-count matching in preserving identification evidence when exact overlap becomes sparse or disappears, demonstrating that semantic ACE matching can complement exact overlap matching when runtime behavior deviates from canonical device profiles.

Key Findings on Matching Performance

In controlled stress tests involving unseen behavior and drifted endpoints, Exact ACE matching reduces to deterministic tie-breaking because no exact ACE overlap remains, causing Top-1 accuracy to collapse. In contrast, both the mean-pooled semantic baseline and ACE-level semantic matching retain high identification accuracy. Under mixed partial observation in real traces, MaxSim achieves higher final identification accuracy than exact hit-count matching when exact overlap decreases, showing that semantic similarity continues to provide useful identification evidence even when exact overlap becomes sparse. Furthermore, the analysis indicates that the correct device typically remains among the highest-ranked candidates even when semantic matching is not the Top-1 prediction.

Conclusion

The study concludes that semantic ACE matching offers a robust method for IoT device identification by providing complementary evidence under evolving runtime behavior. This approach allows for earlier candidate identification during runtime observation and maintains effectiveness even when exact overlap between observed traffic and canonical profiles becomes sparse or absent. The findings demonstrate that semantic ACE matching complements exact overlap matching by providing useful evidence for identification under sparse-overlap conditions.

References

[1] Tadani Nasser Alyahya, Leonardo Aniello, and Vladimiro Sassone. 2024. ScaNeF-IoT: Scalable Network Fingerprinting for IoT Devices. In Proc. ACM ARES. Vienna, Austria.

[8] Ayyob Hamza et al. 2022. Verifying and Monitoring IoTs Network Behavior Using MUD Profiles.

Improvements for AI systems

Based on the provided research paper, here are specific improvements for AI systems and what those improved systems can achieve:

Improve IoT Device Identification Accuracy under Adversarial/Evolving Conditions by implementing a Semantic ACE Matching module.
Implement a system that converts raw network flow records into structured behavioral text (ACE-like primitives) and uses semantic encoders (e.g., BGE-M3) to generate embeddings for each primitive.
Integrate the Whitening Decorrelation step into the embedding pipeline to normalize ACE embeddings, mitigating anisotropy caused by repeated JSON syntax and collapsing whole-profile vectors into a single point, thereby ensuring that behavioral differences are represented in a usable semantic space.
Develop a retrieval mechanism based on an asymmetric MaxSim formulation (late interaction/ColBERT-style) that matches runtime queries (observed ACEs) against the individual embeddings of candidate MUD profiles, rather than relying solely on exact string matching or mean pooling.

This improved AI system can achieve the following:

Identify IoT devices with significantly higher accuracy than current methods when the observed communication patterns deviate from their canonical profile (e.g., due to firmware updates, endpoint changes, or partial observation).
Maintain robust identification performance even when exact communication overlaps between runtime observations and known profiles are sparse or absent (e.g., during unseen ACEs attacks).
Be resilient to lexical variations in device identification (e.g., hostnames changing while protocol/port semantics remain consistent) by leveraging the semantic similarity of the underlying behavioral primitives, rather than relying on brittle exact string matches.
Provide complementary evidence for identification during the early stages of network observation, allowing for faster and more reliable candidate ranking compared to methods that wait for high levels of exact overlap.
Generate a device signature that is not just a single vector (like mean pooling), but an ensemble or set of individual ACE embeddings, preserving fine-grained behavioral distinctions necessary for distinguishing between closely related devices.