Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale

T0 review · 4 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A language model trained on noisy home-network logs identifies 2,015 IoT device vendors with 98.25% top-1 accuracy, staying reliable when metadata is missing, VPN-obfuscated, or deliberately spoofed.

desk verdict A promising LLM-based IoT vendor identification pipeline, but the 98.25% accuracy figure rests on pseudo-label agreement and a subjective manual tier, not independent ground truth. read the letter →

arxiv 2510.13817 v2 pith:H7JHMNN3 submitted 2025-09-24 cs.LG cs.NI

Rameen Mahmood , Tousif Ahmed , Sai Teja Peddinti , Danny Yuxing Huang This is my paper
classification cs.LGcs.NI
keywords IoTdeviceidentificationinstruction-tunedLLMpseudo-labelingnetworkmetadatalong-tailclassificationadversarialrobustnesscurriculumlearningvendor
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that IoT device identification in messy, real-world networks can be turned into a language-understanding task. Instead of matching fixed traffic signatures, the authors treat network metadata—MAC-prefix vendor names, DHCP hostnames, contacted domains, user-agent strings, and free-text labels—as a prompt for an instruction-tuned large language model. They first use prompted LLMs to generate clean vendor labels for over 200,000 devices from the largest known real-world IoT traffic corpus, then fine-tune a compact 8-billion-parameter model on those pseudo-labels. The resulting model reports 98.25% top-1 accuracy across 2,015 vendors, holds up on an independently collected testbed, and resists spoofed or obfuscated inputs. The appeal is that this could give renters, auditors, and network owners a scalable way to answer "what's on my network?" even when devices hide themselves.

What carries the argument

The load-bearing mechanism is a two-stage pipeline. Stage 1 generates pseudo-labels via prompted LLMs with chain-of-thought reasoning and joint vendor/type prediction, consolidates them using a 'Proxy CMI' score (a composite of Adjusted Mutual Information and entropy-based stability) to weight votes, and normalizes aliases to parent brands. Stage 2 instruction-tunes a quantized 8B decoder with vendor-only loss masking (supervision confined to the vendor span) and a two-phase curriculum learning strategy—first on a 35K-device high-signal subset, then on the full 216K-device sparse corpus. The curriculum and span-masked supervision are what let the model generalize from clean anchors to noisy

What would settle it

Manually label a random sample of, say, 1,000 devices from the full 216K corpus—including the long tail and devices with sparse fields—and compare the instruction-tuned model's predictions to those labels. If top-1 agreement falls materially below the reported 98.25%, or if model-human agreement is close to the best pseudo-labeler's kappa of 0.838, then the pseudo-label bottleneck is larger than the paper suggests.

Watch

Extended reading notes

Core claim

The paper establishes that an instruction-tuned 8-billion-parameter language model, supervised with pseudo-labels produced by a consensus of larger LLMs, can identify the vendor of a real-world IoT device from a few partially filled metadata fields, including in the long tail of rare vendors. The authors argue this works because language models can reason over fragmented evidence and draw on pretraining knowledge about brand structure, rather than relying on complete or clean features. They show accuracy holds when fields are missing, when traffic is VPN-obfuscated or years newer than training data, and when metadata is deliberately spoofed; in many cases the model even outputs more canonica

Load-bearing premise

The paper's accuracy numbers rest on the assumption that the pseudo-labels generated by a large LLM, validated against only 245 manually labeled devices, are accurate enough across the full 216,000-device, 2,015-vendor dataset that both training and the reported manual-validation tier reflect genuine vendor identity.

Editorial extensions

If this is right

  • A practical device-inventory tool could run on a single GPU and classify vendors from passive traffic alone, without waiting for device responses.
  • The model's robustness to missing fields and VPN obfuscation suggests it can be deployed in shared or adversarial settings such as short-term rentals and post-abuse recovery audits.
  • Because the model often resolves brands to their parent companies, it can repair inconsistent user-supplied labels and keep network inventories coherent.
  • The approach outperforms a leading commercial lookup-based identification API, which covers only ~36% of devices and systematically mislabels many, indicating a shift from signature databases to semantic inference.
  • The reported tail-vendor accuracy of 95.7% indicates that rare manufacturers are not abandoned, which matters for open-world networks where most vendors are rare.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: The 98.25% figure rests on a manually validated set of only 245 devices drawn from the high-signal subset; the authors concede that pseudo-label noise in the long tail can distort both training and evaluation estimates, so true field accuracy on rare vendors may be lower than reported.
  • Editorial: Because the model leans on pretraining knowledge about brands, its success on well-known vendors like Amazon and Google may not transfer to genuinely novel or obscure manufacturers; a stress test with post-2022 vendors absent from the base model's pretraining would be a sharper measure.
  • Editorial: The same semantic-resilience that resists spoofed user labels could be probed further—an adversary who controls DHCP hostnames and remote domains might eventually learn to produce coordinated spoofs that fool the model, so deployment would need ongoing adversarial evaluation.
  • Editorial: The authors leave device-type and model-level prediction as future work, but their rationales already surface type information (e.g., 'consumer-grade security cameras'), suggesting a hierarchy-aware fine-tune or a simple prompt adjustment could yield type labels at low additional cost.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces a semantic inference pipeline for identifying IoT device vendors from real-world network metadata. Using the IoT Inspector dataset (216K semantically unique devices), the authors generate vendor pseudo-labels with an ensemble of LLMs, guided by a Proxy CMI feature-ranking score, and select Gemini 1.5 Pro with a Joint+CoT prompt based on Cohen's kappa=0.838 against 245 manually labeled high-signal devices. They then instruction-tune a 4-bit QLoRA LLaMA 3.1 8B model in two curriculum phases (35K high-signal, then 216K full). Evaluation is reported on internal holdouts under a tiered scoring scheme, a 245-device manual validation set, the external Mon(IoT)r testbed, and qualitative adversarial/perturbation cases. The headline result is 98.25% top-1 and 90.73% macro accuracy across 2,015 vendors.

Significance. If the headline accuracy were measured against independent ground truth, the paper would be a useful advance: it is among the first to apply instruction-tuned LLMs to passive IoT device identification at scale, and the use of a large real-world corpus, temporal/geographic/VPN testbed, feature ablations, and open-set probes are valuable. The external testbed and ablation experiments provide some evidence of generalization. However, the central quantitative claim is not yet established. The 98.25% figure is computed under a 'Manual Validation Tier' that credits semantically plausible predictions and relies on the same 245-device set used to select the pseudo-labeling prompt; strict agreement with pseudo-labels is only 70.4% (Table 3). The paper itself acknowledges (Section 6) that pseudo-label quality 'can distort both training and evaluation estimates.' Because the student model is trained to imitate the teacher LLM, high agreement between them is partly a self-consistency result. The contribution, while promising, requires an independent evaluation protocol before the reported accuracy can be accepted.

major comments (4)
  1. [§5.1, Table 3] The headline 98.25% top-1 accuracy is not an independent estimate. The 'Manual Validation Tier' rubric is not specified, no inter-annotator agreement or blinding is reported, and the 245-device manual set is the same set used to select the Joint+CoT prompt and Gemini model (Section 4.1.3). Strict string match to the pseudo-labels that also served as training targets is only 70.4% in Phase II. Since the instruction-tuned model was trained on Gemini-generated pseudo-labels, agreement with those pseudo-labels reflects teacher-student consistency as much as true vendor identity. The footnote to Table 3 stating that all accuracy figures correspond to the Manual Validation Tier makes the primary metric unfalsifiable as reported.
  2. [§4.1.3 / §6] The pseudo-label quality of the teacher is established only on 245 devices drawn from the 35K high-signal subset (devices with at least one remote_hostname). This sample cannot certify label quality over the full 216K-device corpus and 2,015-vendor long tail, where more than half the devices lack user labels and many classes have ≤10 samples (Table 4). The paper's own limitation statement (Section 6) says 'pseudo-label quality remains a bottleneck' and can 'distort both training and evaluation estimates.' No independent validation set from the full distribution is provided, so the reported phase-II gains on tail classes (95.70%) cannot be separated from teacher-label noise.
  3. [§5.2, Table 5] The external testbed contains only 93 devices, with per-condition samples of 5–50 devices (e.g., n=5 for UK VPN), and the text acknowledges that some testbed labels specify device type rather than vendor (e.g., 'fridge' vs Samsung). With no explicit protocol for resolving these label mismatches, the reported 88.2–100% figures are not a rigorous substitute for independent validation across 2,015 vendors. The external evidence supports robustness to distribution shift but not the headline 98.25% accuracy.
  4. [§5.4.2–5.4.3, Figs. D.2–D.3] The robustness claims in the abstract are supported only by a small number of curated examples. No aggregate accuracy, false-positive rates, or comparison against a non-adversarial baseline are reported for spoofed user labels, spoofed DHCP hostnames, or token perturbations. Without quantitative evaluation, the claim that the model 'remains robust' to adversarial manipulation is not established.
minor comments (5)
  1. [Abstract vs. §5.1] The abstract block provided with the submission reports 98.69% top-1 accuracy, whereas the full-text abstract and Section 5.1 report 98.25%. Please correct the inconsistency.
  2. [Table 3, footnote 4] The relationship between 'Strict Match,' 'Unified Label Tier,' and 'Manual Validation Tier' needs a precise definition. Footnote 4 says all accuracy figures use the Manual Validation Tier, which makes Table 2 ambiguous; report strict and tiered numbers side by side.
  3. [References] Reference [16] has a malformed author string ('Rafael Rafailov Kanishk Gandhi'), and [27] is formatted as a standards reference without a clear title. Please check all references for consistency.
  4. [Reproducibility] No code or data availability statement is provided. Given the reliance on LLM vendor APIs (Gemini/GPT) and proprietary IoT Inspector data, a statement about releasing prompts and evaluation scripts would aid reproducibility.
  5. [§4.1.2, Eq. (4)] Proxy CMI uses alpha=0.5 without sensitivity analysis. While not central to the main claim, a brief robustness check over alpha would strengthen the feature-ranking analysis.

Circularity Check

1 steps flagged · score 6.0 of 10

Headline 98.25% accuracy is measured against the same LLM-generated pseudo-labels used for training, with a subjective manual tier; independent testbed evidence supports only 88–94% on 93 devices, so the central claim is partially circular.

  1. fitted input called prediction [Section 4.1.3, Section 4.2, Section 5.1 (Tables 2–3)]
    "we conduct an ablation study ... selecting Gemini 1.5 Pro with Joint + CoT as the strongest configuration and applying it to label the full dataset. ... We instruction-tune a causal decoder-only model (LLaMA 3.1 8B) on semi-structured metadata using pseudo-labels generated via our ensemble pipeline ... Strict matching to pseudo-labels yields 63.4% accuracy in Phase I and 70.4% in Phase II. ... A final Manual Validation Tier adjudicates irreducibly ambiguous cases, crediting semantically plausible predictions and raising accuracy to 97.54% and 98.25%—consistent with the Top-1 figures in Table 2"

    The instruction-tuned model is trained to reproduce Gemini's pseudo-labels, and the internal holdout reference labels come from the same pseudo-labeling pipeline. Top-1 'accuracy' on those holdouts therefore measures student–teacher agreement (plus subjective human adjudication) rather than independent vendor identification. The Manual Validation Tier is not independent ground truth: it credits 'semantically plausible' predictions with no stated rubric, blind protocol, or inter-annotator agreement, and the 245-device set it draws on was already used to select the teacher. Thus the reported 98.25% is partly a self-consistency measure, as Section 6 concedes: 'pseudo-label quality ... can distort both training and evaluation estimates.'

full rationale

Stage 1 selects Gemini 1.5 Pro Joint+CoT by kappa=0.838 on 245 manually labeled high-signal devices and applies it to label the full 216K-device corpus. Stage 2 trains LLaMA 3.1 8B on those same pseudo-labels. The internal holdout sets are 10% splits of the pseudo-labeled data, and the headline top-1 figures are obtained by adding a Manual Validation Tier that credits any 'semantically plausible' prediction; footnote 4 says all accuracy figures use this tier. Consequently, the 98.25% figure measures how well the student reproduces teacher judgments after human adjudication, not accuracy against an independent long-tail ground truth. The independent Mon(IoT)r testbed gives 88–94% on 93 devices, far below the headline. Section 6 explicitly admits pseudo-label quality 'can distort both training and evaluation estimates.' This is a partial but real circularity: the central 'prediction' is evaluated against the same pseudo-label distribution that generated its supervision. There is no self-citation chain or uniqueness import; the independent testbed and 245-device manual set provide some external grounding, so the paper is not wholly circular, but the headline metric is not established independently.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

Everything the central claim rests on: LLM pseudo-labels as ground truth, a 245-device manual validation set used for both selection and evaluation, the Mon(IoT)r testbed labels, and the OUI anchor. No new physical entities are invented.

free parameters (4)
  • High-signal subset criterion = device with at least one remote_hostname (35K devices)
    Data selection choice that defines Phase I training set; affects curriculum and reported Phase I metrics.
  • Proxy CMI alpha = 0.5
    Equal weight for Stability and AMI in Eq. 4; chosen by hand, no sensitivity analysis.
  • Manual validation tier rubric = not quantified; includes semantic alignment, brand consolidation, ambiguous label exclusion, manual validation
    Subjective criteria used to transform strict match (70.4%) into headline top-1 (98.25%); effectively a free parameter that inflates accuracy.
  • LoRA hyperparameters = r=8, alpha=16, dropout=0.05, lr=2e-4
    Standard hyperparameters, but not justified by tuning; affect final performance.
assumptions (4)
  • domain assumption LLM-generated pseudo-labels approximate ground truth sufficiently for training
    The entire pipeline depends on the assumption that Gemini 1.5 Pro with Joint+CoT produces accurate vendor labels (kappa 0.838 on 245 devices) and that this accuracy transfers to the full 216K dataset. The paper itself notes pseudo-label quality is a bottleneck.
  • domain assumption 245-device manually labeled set is representative and unbiased
    Used for prompt selection, for hold-out accuracy, and for tiered evaluation; if this set is not representative (e.g., dominated by high-signal cases), the headline accuracy is overestimated.
  • domain assumption Mon(IoT)r testbed labels correspond to vendor identities
    External evaluation relies on the testbed dataset (Girish et al.) having accurate vendor labels; the paper notes label mismatches (fridge vs Samsung) and handles them by crediting the model.
  • domain assumption OUI/MAC prefix is a useful anchor despite spoofability
    Used as primary feature; the paper acknowledges OUIs are assigned to third-party vendors and can be spoofed, but the model's robustness is only demonstrated on a few qualitative examples.

how reviews work

0 comments
Cite this review

Pith. "Pith review of What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale." pith.science (2026). https://pith.science/paper/H7JHMNN3

@misc{pith2026251013817,
  author       = {Pith},
  title        = {Pith review of: What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H7JHMNN3}},
  note         = {Machine review of arXiv:2510.13817}
}
read the original abstract

The growth of IoT devices in shared environments has outpaced our ability to identify them, posing urgent risks to privacy, safety, and accountability. This challenge is especially pronounced in open-world environments, where network traffic metadata is often sparse, noisy, or adversarial. To address this problem, we introduce a semantic inference pipeline that reframes device identification as a language modeling task over real-world network metadata. As this approach depends on reliable supervision, we first construct high-fidelity vendor labels for the IoT Inspector dataset, the largest real-world corpus of its kind, using an ensemble of large language models guided by mutual-information and entropy-based stability scores. We then instruction-tune a quantized LLaMA 3.1 8B model on this dataset using curriculum learning to support generalization under sparsity and long-tail vendor distributions. Our model achieves 98.69% top-1 and 90.73% macro accuracy across 2,015 vendors, while remaining robust to missing fields, protocol drift, and adversarial manipulation. We also evaluate the model on an independent IoT testbed dataset, assess explanation quality, and conduct adversarial tests to probe robustness under spoofed and obfuscated input. These results position instruction-tuned LLMs as a scalable, interpretable foundation for trustworthy device identification at scale.

Figures

Figures reproduced from arXiv: 2510.13817 by the authors.

Figure 1
Figure 1. Multi-Stage Pipeline for Device-Level Signature Extraction. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Curriculum-style instruction-tuning strategy. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Learning Behavioral Signals from Encrypted Smartphone Network Traffic

    cs.LG 2026-05 unverdicted novelty 6.0 of 10

    Encrypted network traffic from smartphones reveals distinct longitudinal behavioral patterns for sleep, stress, and loneliness through transformer representations and sparse autoencoders that capture within-person cha...

  2. Learning Behavioral Signals from Encrypted Smartphone Network Traffic

    cs.LG 2026-05 unverdicted novelty 5.0 of 10

    Transformer models with user adapters extract behavioral signals from encrypted network traffic that correlate with stress, loneliness, and sleep issues via sparse features and GEE models, outperforming handcrafted fe...

Reference graph

Works this paper leans on

79 extracted references · 1 canonical work pages · cited by 1 Pith paper

  1. [1]

    A World of Wireless, Mobile and Multimedia Networks

    Areej Albataineh and Izzat Alsmadi. 2019. Iot and the risk of internet exposure: Risk assessment using shodan queries. In2019 IEEE 20th International Symposium on" A World of Wireless, Mobile and Multimedia Networks"(WoWMoM). IEEE, 1–5

    2019

  2. [2]

    Sandhya Aneja, Nagender Aneja, and Md Shohidul Islam. 2018. IoT device fingerprint using deep learning. In2018 IEEE international conference on internet of things and intelligence system (IOTAIS). IEEE, 174–179

    2018

  3. [3]

    Apple. 2010. Bonjour Service Discovery Suite. https://developer.apple.com/ bonjour/ Accessed: 2025-07-30

    2010

  4. [4]

    Noah Apthorpe, Dillon Reisman, and Nick Feamster. 2017. A smart home is no cas- tle: Privacy vulnerabilities of encrypted iot traffic.arXiv preprint arXiv:1705.06805 (2017)

    arXiv 2017

  5. [5]

    Avahi. 2010. Avahi Service Discovery Suite. http://www.avahi.org/ Accessed: 2025-07-30

    2010

  6. [6]

    Benjamin Avanzi, Greg Taylor, Melantha Wang, and Bernard Wong. 2024. Ma- chine learning with high-cardinality categorical features in actuarial applications. ASTIN Bulletin: The Journal of the IAA54, 2 (2024), 213–238

    2024

  7. [7]

    Randeep Bhatia, Steven Benno, Jairo Esteban, TV Lakshman, and John Grogan

  8. [8]

    Bluetooth Special Interest Group (SIG). 2016. Bluetooth Core Specification v5.0. https://www.bluetooth.com/specifications/specs/core-specification/ Accessed: 2025-07-30

    2016

Show all 79 references
  1. [9]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners.Advances in neural information processing systems33 (2020), 1877–1901

    2020

  2. [10]

    Rose Ceccio, Sophie Stephenson, Varun Chadha, Danny Yuxing Huang, and Rahul Chatterjee. 2023. Sneaky Spy Devices and Defective Detectors: The Ecosystem of Intimate Partner Surveillance with Covert Devices. In32nd USENIX Security Symposium (USENIX Security 23). USENIX Associati...

    2023

  3. [11]

    Poornima M Chanal and Mahabaleshwar S Kakkasageri. 2020. Security and privacy in IoT: a survey.Wireless Personal Communications115, 2 (2020), 1667– 1693

    2020

  4. [12]

    Xin Chen, Hanxian Huang, Yanjun Gao, Yi Wang, Jishen Zhao, and Ke Ding

  5. [13]

    Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. 2023. Qlora: Efficient finetuning of quantized llms.Advances in neural information processing systems36 (2023), 10088–10115

    2023

  6. [14]

    Frank Ebbers. 2022. A large-scale analysis of iot firmware version distribution in the wild.IEEE Transactions on Software Engineering49, 2 (2022), 816–830

    2022

  7. [15]

    Omair Faraj, David Megias, and Joaquin Garcia-Alfaro. 2025. Security Approaches for Data Provenance in the Internet of Things: A Systematic Literature Review. Comput. Surveys57, 10 (2025), 1–41

    2025

  8. [16]

    Jan-Philipp Fränken, Eric Zelikman, Rafael Rafailov Kanishk Gandhi, and Tobias Gerstenberg Noah D Goodman. 2024. Self-Supervised Alignment with Mutual Information.arXiv preprint arXiv:2404.14313(2024)

    2024 arXiv

  9. [17]

    a stalker’s paradise

    Diana Freed, Jackeline Palmer, Diana Minchala, Karen Levy, Thomas Ristenpart, and Nicola Dell. 2018. “a stalker’s paradise” how intimate partner abusers ex- ploit technology. InProceedings of the 2018 CHI conference on human factors in computing systems. 1–13

    2018

  10. [18]

    Aniketh Girish, Tianrui Hu, Vijay Prakash, Daniel J Dubois, Srdjan Matic, Danny Yuxing Huang, Serge Egelman, Joel Reardon, Juan Tapiador, David Choffnes, et al. 2023. In the room where it happens: Characterizing local commu- nication and threats in smart homes. InProceedings o...

    2023

  11. [19]

    Xiao Gu, Yao Guo, Zeju Li, Jianing Qiu, Qi Dou, Yuxuan Liu, Benny Lo, and Guang- Zhong Yang. 2022. Tackling long-tailed category distribution under domain shifts. InEuropean Conference on Computer Vision. Springer, 727–743

    2022

  12. [20]

    Jorge Luis Guerra, Carlos Catania, and Eduardo Veas. 2022. Datasets are not enough: Challenges in labeling network traffic.Computers & Security120 (2022), 102810

    2022

  13. [21]

    Isabelle Guyon and André Elisseeff. 2003. An introduction to variable and feature selection.Journal of machine learning research3, Mar (2003), 1157–1182

    2003

  14. [22]

    Stefan Gvozdenovic, Johannes K Becker, John Mikulskis, and David Starobinski

  15. [23]

    Danny Hernandez, Tom Brown, Tom Conerly, Nova DasSarma, Dawn Drain, Sheer El-Showk, Nelson Elhage, Zac Hatfield-Dodds, Tom Henighan, Tristan Hume, et al. 2022. Scaling laws and interpretability of learning from repeated data.arXiv preprint arXiv:2205.10487(2022)

    2022 arXiv

  16. [24]

    Shohreh Hosseinzadeh, Sami Hyrynsalmi, and Ville Leppänen. 2016. Obfuscation and diversification for securing the internet of things (IoT). InInternet of things. Elsevier, 259–274

    2016

  17. [25]

    Danny Yuxing Huang. 2022. Three Years of Crowdsourcing Network Traffic from Smart Homes.USENIX ;login: Magazine(June 2022)

    2022

  18. [26]

    Danny Yuxing Huang, Noah Apthorpe, Frank Li, Gunes Acar, and Nick Feamster

  19. [27]

    IEEE. 2015. IEEE Standard for Low-Rate Wireless Networks, IEEE Standard 802.15.4-2015. IEEE Standard 802.15.4-2015

    2015

  20. [28]

    International Telecommunication Union. 2015. G.9959: Short Range Narrow- band Digital Radiocommunication Transceivers—PHY, MAC, SAR and LLC Layer Specifications. https://www.itu.int/rec/T-REC-G.9959 Accessed: 2025-07-30

    2015

  21. [29]

    Hossein Jafari, Oluwaseyi Omotere, Damilola Adesina, Hsiang-Huang Wu, and Lijun Qian. 2018. IoT devices fingerprinting using deep learning. InMILCOM 2018-2018 IEEE Military Communications Conference (MILCOM). IEEE, 1–9

    2018

  22. [30]

    John Kurkowski. 2024. tldextract: Domain Extraction Library. https://github. com/john-kurkowski/tldextract. Accessed: 2025-07-24

    2024

  23. [31]

    Georgios Kambourakis, Constantinos Kolias, and Angelos Stavrou. 2017. The mirai botnet and the iot zombie armies. InMILCOM 2017-2017 IEEE military communications conference (MILCOM). IEEE, 267–272

    2017

  24. [32]

    Nikhil Kandpal, Eric Wallace, and Colin Raffel. 2022. Deduplicating training data mitigates privacy risks in language models. InInternational Conference on Machine Learning. PMLR, 10697–10707

    2022

  25. [33]

    Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. Large language models are zero-shot reasoners.Advances in neural information processing systems35 (2022), 22199–22213

    2022

  26. [34]

    Constantinos Kolias, Georgios Kambourakis, Angelos Stavrou, and Jeffrey Voas

  27. [35]

    Jannik Kossen, Jiatong Han, Muhammed Razzak, Lisa Schut, Shreshth Malik, and Yarin Gal. 2024. Semantic entropy probes: Robust and cheap hallucination detection in llms.arXiv preprint arXiv:2406.15927(2024)

    2024 arXiv

  28. [36]

    Josephine Lau, Benjamin Zimmerman, and Florian Schaub. 2018. Alexa, are you listening? Privacy perceptions, concerns and privacy-seeking behaviors with smart speakers.Proceedings of the ACM on human-computer interaction2, CSCW (2018), 1–31

    2018

  29. [37]

    Katherine Lee, Daphne Ippolito, Andrew Nystrom, Chiyuan Zhang, Douglas Eck, Chris Callison-Burch, and Nicholas Carlini. 2021. Deduplicating training data makes language models better.arXiv preprint arXiv:2107.06499(2021)

    2021 arXiv

  30. [38]

    Sejun Lee, Jaehoon Paul Jeong, and Jung-Soo Park. 2016. DNSNA: DNS name auto- configuration for Internet of Things devices. In2016 18th International Conference on Advanced Communication Technology (ICACT). IEEE, 410–416

    2016

  31. [39]

    Tao Lei, Regina Barzilay, and Tommi Jaakkola. 2016. Rationalizing neural predic- tions.arXiv preprint arXiv:1606.04155(2016)

    2016 arXiv

  32. [40]

    Guozheng Li, Peng Wang, and Wenjun Ke. 2023. Revisiting large language models as zero-shot relation extractors.arXiv preprint arXiv:2310.05028(2023)

    2023 arXiv

  33. [41]

    Sha Li, Ruining Zhao, Manling Li, Heng Ji, Chris Callison-Burch, and Jiawei Han. 2023. Open-domain hierarchical event schema induction by incremental prompting and verification.arXiv preprint arXiv:2307.01972(2023)

    2023 arXiv

  34. [42]

    Zixuan Liang. 2025. Efficient Representations for High-Cardinality Categorical Variables in Machine Learning.arXiv preprint arXiv:2501.05646(2025)

    2025 arXiv

  35. [43]

    Xiangyu Liu, Yi Han, and Yanhui Du. 2022. IoT device identification using directional packet length sequences and 1D-CNN.Sensors22, 21 (2022), 8337

    2022

  36. [44]

    Yongxin Liu, Jian Wang, Jianqiang Li, Shuteng Niu, and Houbing Song. 2021. Machine learning for the detection and identification of Internet of Things devices: A survey.IEEE Internet of Things Journal9, 1 (2021), 298–320

    2021

  37. [45]

    Zifan Liu, Amin Karbasi, and Theodoros Rekatsinas. 2024. TSDS: Data Selection for Task-Specific Model Finetuning.arXiv preprint arXiv:2410.11303(2024)

    2024 arXiv

  38. [46]

    Manuel Lopez-Martin, Belen Carro, Antonio Sanchez-Esguevillas, and Jaime Lloret. 2017. Network traffic classifier with convolutional and recurrent neural networks for Internet of Things.IEEE access5 (2017), 18042–18050

    2017

  39. [47]

    Jinliang Lu, Chen Wang, and Jiajun Zhang. 2024. Diver: Large language model decoding with span-level mutual information verification.arXiv preprint arXiv:2406.02120(2024)

    2024 arXiv

  40. [48]

    2009.Nmap network scanning: The official Nmap project guide to network discovery and security scanning

    Gordon Fyodor Lyon. 2009.Nmap network scanning: The official Nmap project guide to network discovery and security scanning. Insecure

    2009

  41. [49]

    Rohan Mahy, Philip Matthews, and Jonathan Rosenberg. 2010. Traversal Using Relays around NAT (TURN): Relay Extensions to Session Traversal Utilities for NAT (STUN). RFC 5766. https://doi.org/10.17487/RFC5766

    2010 doi

  42. [50]

    Potsawee Manakul, Adian Liusie, and Mark JF Gales. 2023. Selfcheckgpt: Zero- resource black-box hallucination detection for generative large language models. arXiv preprint arXiv:2303.08896(2023)

    2023 arXiv

  43. [51]

    Markus Miettinen, Samuel Marchal, Ibbad Hafeez, Nadarajah Asokan, Ahmad- Reza Sadeghi, and Sasu Tarkoma. 2017. Iot sentinel: Automated device-type identification for security enforcement in iot. In2017 IEEE 37th international conference on distributed computing systems (ICDCS)...

    2017

  44. [52]

    Moran Mizrahi, Guy Kaplan, Dan Malkin, Rotem Dror, Dafna Shahaf, and Gabriel Stanovsky. 2024. State of what art? a call for multi-prompt llm evaluation. Transactions of the Association for Computational Linguistics12 (2024), 933–949

    2024

  45. [53]

    Andrew W Moore and Denis Zuev. 2005. Internet traffic classification using bayesian analysis techniques. InProceedings of the 2005 ACM SIGMETRICS inter- national conference on Measurement and modeling of computer systems. 50–60

    2005

  46. [54]

    Nizar Msadek, Ridha Soua, and Thomas Engel. 2019. Iot device fingerprint- ing: Machine learning based encrypted traffic analysis. In2019 IEEE wireless communications and networking conference (WCNC). IEEE, 1–8

    2019

  47. [55]

    Jorge Ortiz, Catherine Crawford, and Franck Le. 2019. DeviceMien: network device behavior modeling for identifying unknown IoT devices. InProceedings of the International Conference on Internet of Things Design and Implementation. 106–117

    2019

  48. [56]

    Ethan Perez, Douwe Kiela, and Kyunghyun Cho. 2021. True few-shot learning with language models.Advances in neural information processing systems34 (2021), 11054–11070

    2021

  49. [57]

    Stefano Perone, Luca Faramondi, and Roberto Setola. 2023. Default Credentials Vulnerability: The Case Study of Exposed IP Cams. In2023 IEEE International Conference on Cyber Security and Resilience (CSR). IEEE, 406–411

    2023

  50. [58]

    Zexuan Qiu, Zijing Ou, Bin Wu, Jingjing Li, Aiwei Liu, and Irwin King. 2024. Entropy-based decoding for retrieval-augmented large language models.arXiv preprint arXiv:2406.17519(2024)

    2024 arXiv

  51. [59]

    Ola Salman, Imad H Elhajj, Ali Chehab, and Ayman Kayssi. 2022. A machine learning based framework for IoT device identification and abnormal traffic detection.Transactions on Emerging Telecommunications Technologies33, 3 (2022), e3743

    2022

  52. [60]

    Armin Sarabi, Tongxin Yin, and Mingyan Liu. 2023. An llm-based framework for fingerprinting internet-connected devices. InProceedings of the 2023 ACM on Internet Measurement Conference. 478–484

    2023

  53. [61]

    Arunan Sivanathan, Hassan Habibi Gharakheili, Franco Loi, Adam Radford, Chamith Wijenayake, Arun Vishwanath, and Vijay Sivaraman. 2018. Classifying IoT devices in smart environments using network traffic characteristics.IEEE Transactions on Mobile Computing18, 8 (2018), 1745–1759

    2018

  54. [62]

    Vijay Sivaraman, Hassan Habibi Gharakheili, Clinton Fernandes, Narelle Clark, and Tanya Karliychuk. 2018. Smart IoT devices in the home: Security and privacy implications.IEEE Technology and Society Magazine37, 2 (2018), 71–79

    2018

  55. [63]

    Sophie Stephenson, Majed Almansoori, Pardis Emami-Naeini, Danny Yuxing Huang, and Rahul Chatterjee. 2023. Abuse Vectors: A Framework for Conceptu- alizing IoT-Enabled Interpersonal Abuse. In32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, 6...

    2023

  56. [64]

    Ali Tekeoglu and Ali Saman Tosun. 2015. Investigating security and privacy of a cloud-based wireless IP camera: NetCam. In2015 24th International Conference on Computer Communication and Networks (ICCCN). IEEE, 1–6

    2015

  57. [65]

    Johannes Treutlein, Dami Choi, Jan Betley, Samuel Marks, Cem Anil, Roger B Grosse, and Owain Evans. 2024. Connecting the dots: Llms can infer and verbalize latent structure from disparate training data.Advances in Neural Information Processing Systems37 (2024), 140667–140730

    2024

  58. [66]

    Imtiaz Ullah and Qusay H Mahmoud. 2022. Design and development of RNN anomaly detection model for IoT networks.IEEE Access10 (2022), 62722–62750

    2022

  59. [67]

    Jialiang Wang, Xiong Zhou, Deming Zhai, Junjun Jiang, Xiangyang Ji, and Xian- ming Liu. 2024. 𝜖-Softmax: Approximating One-Hot Vectors for Mitigating Label Noise.Advances in Neural Information Processing Systems37 (2024), 32012–32038

    2024

  60. [68]

    Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc Le, Ed Chi, and Denny Zhou

  61. [69]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems35 (2022), 24824–24837

    2022

  62. [70]

    Wikidata Contributors. 2024. Wikidata Query Service. https://query.wikidata.org. Accessed: 2025-07-24

    2024

  63. [71]

    Xuansheng Wu, Jiayi Yuan, Wenlin Yao, Xiaoming Zhai, and Ninghao Liu. 2025. Interpreting and steering llms with mutual information-based explanations on sparse autoencoders.arXiv preprint arXiv:2502.15576(2025)

    2025 arXiv

  64. [72]

    Teng Xiao, Zhen Ge, Sujay Sanghavi, Tian Wang, Julian Katz-Samuels, Skylar Versage, Qingjun Cui, and Trishul Chilimbi. 2025. InfoPO: On mutual information maximization for large language model alignment. (2025)

    2025

  65. [73]

    Explanation

    Shize Zhang, Zhiliang Wang, Jiahai Yang, Dongbin Bai, Fuliang Li, Zimu Li, Jianping Wu, and Xinran Liu. 2021. Unsupervised IoT fingerprinting method via variational auto-encoder and k-means. InICC 2021-IEEE International Conference on Communications. IEEE, 1–6. Figure A.1: Pro...

    2021

  66. [2017]

    DDoS in the IoT: Mirai and other botnets.Computer50, 7 (2017), 80–84

    2017

  67. [2019]

    InProceedings of the 3rd acm conext workshop on big data, machine learning and artificial intelligence for data communication networks

    Unsupervised machine learning for network-centric anomaly detection in IoT. InProceedings of the 3rd acm conext workshop on big data, machine learning and artificial intelligence for data communication networks. 42–48

  68. [2020]

    Iot inspector: Crowdsourcing labeled network traffic from smart home devices at scale.Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies4, 2 (2020), 1–21

    2020

  69. [2022]

    Rationale-augmented ensembles in language models.arXiv preprint arXiv:2207.00747(2022)

    2022 arXiv

  70. [2023]

    IoT-scan: Network reconnaissance for Internet of Things.IEEE Internet of Things Journal11, 8 (2023), 13091–13107

    2023

  71. [2024]

    arXiv preprint arXiv:2403.03348(2024)

    Learning to maximize mutual information for chain-of-thought distillation. arXiv preprint arXiv:2403.03348(2024)

    2024 arXiv

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.