首页 期刊 论文 学科刊群 资讯 加盟 关于
EN
image
Article(id=1254010453374464633, tenantId=1146029695717560320, journalId=1251234646239789153, issueId=1254010452460106357, articleNumber=null, orderNo=null, doi=10.12399/j.issn.2097-163x.2025.05.002, pmid=null, cstr=null, oa=null, hot=null, price=null, onlineType=0, articleFormat=0, articleType=null, articleTypeStr=null, receivedDate=1751472000000, receivedDateStr=2025-07-03, revisedDate=1757347200000, revisedDateStr=2025-09-09, acceptedDate=null, acceptedDateStr=null, onlineDate=1776908990472, onlineDateStr=2026-04-23, pubDate=null, pubDateStr=null, doiRegisterDate=null, doiRegisterDateStr=null, onlineIssueDate=1776908990472, onlineIssueDateStr=2026-04-23, onlineJustAcceptDate=null, onlineJustAcceptDateStr=null, onlineFirstDate=null, onlineFirstDateStr=null, sourceXml=null, magXml=null, createTime=1776908990472, creator=13041195026, updateTime=1776908990472, updator=13041195026, issue=Issue{id=1254010452460106357, tenantId=1146029695717560320, journalId=1251234646239789153, year='2025', volume='4', issue='5', pageStart='1', pageEnd='96', issueExtLink='null', onlineDate='null', pubDate='null', beforeIssueId=null, nextIssueId=null, price=null, status=1, issueComplete=1, articleOrder=1, issueType=1, specialIssue=null, createTime=1776908990253, creator=13041195026, updateTime=1777355431505, updator=13041195026, preIssue=null, nextIssue=null, ext={EN=IssueExt(id=1255882962894242489, tenantId=1146029695717560320, journalId=1251234646239789153, issueId=1254010452460106357, language=EN, specialIssueTitle=, coverIllustrator=null, specialIssueEditor=, specialIssueAbout=), CN=IssueExt(id=1255882962894242490, tenantId=1146029695717560320, journalId=1251234646239789153, issueId=1254010452460106357, language=CN, specialIssueTitle=, coverIllustrator=null, specialIssueEditor=, specialIssueAbout=)}, issueFiles=null}, startPage=22, endPage=41, ext={EN=ArticleExt(id=1254010454024581757, articleId=1254010453374464633, tenantId=1146029695717560320, journalId=1251234646239789153, language=EN, title=IoT device identification method enhanced by packet-level traffic semantic features for large language models, columnId=1254010453361881720, journalTitle=Information Countermeasure Technology, columnName=Research Articles, runingTitle=null, highlight=null, articleAbstract=

With the rapid popularization of Internet of Things（IoT）technology in various fields，network device identification has become a key link in the network security protection system. Real-time detection of IoT devices accessing the network is crucial for network management，security protection，and performance optimization. Accurately understanding network dynamics and identifying these IoT devices is a necessary prerequisite for effectively defending against hacker attacks. Traditional machine learning-based identification methods not only suffer from low efficiency，complex feature selection，and poor environmental transferability，but their accuracy also fails to meet the needs of practical protection. To address this issue，an IoT device identification method based on packet-level traffic semantic feature-enhanced large language models（LLM）was proposed. First，complex and heterogeneous IoT traffic was converted into universal packet-level traffic semantic features. Then，these packet-level traffic semantic features were used to fine-tune the LLM，enabling the LLM to automatically learn the potential traffic features of IoT devices and make device classification and identification decisions，thereby realizing end-to-end and efficient IoT device identification. Experimental results on the public datasets Aalto，UNSW，and hybrid CIC IoT datasets（2022，2023）show that the proposed method can effectively identify IoT devices based on packet-level traffic semantic features，and its the average identification accuracy can reach 99.99%，99.42%，and 98.83% respectively.

, correspAuthors=null, authorNote=null, correspAuthorsNote=null, copyrightStatement=null, copyrightOwner=null, extLink=null, articleAbsUrl=null, sourceXml=null, magXml=null, pdfUrl=null, pdf=null, pdfFileSize=null, pdfExtLink=null, richHtmlUrl=null, mobilePdfUrl=null, reviewReport=null, pdfFirstPage=null, abstractGraph=null, abstractGraphContent=null, abstractVideo=null, citation=null, cebUrl=null, magXmlContent=null, mapNumber=null, authorCompany=null, fund=null, authors=null, authorsList=Xinyu YIN, Fan SHI, Chengxi XU, Jiancheng ZHANG, Mingyi GE), CN=ArticleExt(id=1254010463889584875, articleId=1254010453374464633, tenantId=1146029695717560320, journalId=1251234646239789153, language=CN, title=基于分组级流量语义特征增强的LLM IoT设备识别方法, columnId=1254010453533848188, journalTitle=信息对抗技术, columnName=研究论文, runingTitle=null, highlight=null, articleAbstract=

随着物联网（IoT）技术在各领域的快速普及，网络设备识别已经成为网络安全防护体系的关键环节，实时发现接入网络的IoT设备对于网络管理、安全防护和性能优化至关重要。准确掌握网络动态并识别这些IoT设备，是有效防御黑客攻击的必要前提。传统机器学习的识别方法不仅效率低下、特征选取复杂、环境迁移能力差，其准确率也难以满足实际防护需求。为此，提出了一种基于分组级流量语义特征增强的大语言模型（LLM）IoT设备识别方法。首先，将复杂异构的IoT流量转化为通用的分组级流量语义特征；然后，使用分组级流量语义特征微调LLM，使LLM能够自动学习潜在IoT设备流量特征并执行设备分类识别决策，从而实现端到端高效的IoT设备识别。在公开数据集Aalto、UNSW和混合CIC IoT数据集（2022、2023）上的实验结果表明，所提方法能够基于分组级流量语义特征有效识别IoT设备，并且该方法的平均识别准确率分别达到99.99%、99.42%、98.83%。

, correspAuthors=null, authorNote=null, correspAuthorsNote=
通信作者：施凡，E-mail:
, copyrightStatement=null, copyrightOwner=null, extLink=null, articleAbsUrl=null, sourceXml=zT9UqVe9UoKbAOiKF984nA==, magXml=1wC3uDvxRPGd3ktBMG8D6A==, pdfUrl=null, pdf=CCQ1iT0ejdjMhqr4OrdP7w==, pdfFileSize=7252476, pdfExtLink=null, richHtmlUrl=null, mobilePdfUrl=null, reviewReport=null, pdfFirstPage=null, abstractGraph=qPY4o13HEcK3D1tV4P4aWA==, abstractGraphContent=null, abstractVideo=null, citation=null, cebUrl=null, magXmlContent=r6VvPxOzyw9iJ0es+jYRPA==, mapNumber=null, authorCompany=null, fund=null, authors=

尹鑫宇　男，2002年生，硕士研究生，研究方向为网络空间测绘 E-mail:

施凡　男，1983年生，博士，教授，研究方向为网络空间测绘和网络空间测量 E-mail:

许成喜　男，1989年生，博士，副教授，研究方向为互联网基础设施安全和网络空间测绘 E-mail:

章建成　男，2004年生，硕士研究生，研究方向为网络空间测绘 E-mail:

葛明仪女，2003年生，硕士研究生，研究方向为网络空间测绘 E-mail:

, authorsList=尹鑫宇, 施凡, 许成喜, 章建成, 葛明仪)}, authors=[Author(id=1254010465810576118, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, orderNo=0, firstName=null, middleName=null, lastName=null, nameCn=null, orcid=null, stid=null, country=null, authorPic=null, dead=0, email=yinxinyu@nudt.edu.cn, emailSecond=null, emailThird=null, correspondingAuthor=0, authorType=1, ext={EN=AuthorExt(id=1254010465919628027, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010465810576118, language=EN, stringName=Xinyu YIN, firstName=Xinyu, middleName=null, lastName=YIN, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China, bio=null, bioImg=null, bioContent=null, aboutCorrespAuthor=null), CN=AuthorExt(id=1254010466007708413, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010465810576118, language=CN, stringName=尹鑫宇, firstName=null, middleName=null, lastName=null, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=国防科技大学电子对抗学院，安徽　合肥　230037, bio={"img":"UKHj3mvSh3T47OzUR24BXg==","content":"

尹鑫宇　男，2002年生，硕士研究生，研究方向为网络空间测绘 E-mail:

"}, bioImg=UKHj3mvSh3T47OzUR24BXg==, bioContent=

尹鑫宇　男，2002年生，硕士研究生，研究方向为网络空间测绘 E-mail:

, aboutCorrespAuthor=null)}, companyList=[AuthorCompany(id=1254010464292238065, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, xref=null, ext=[AuthorCompanyExt(id=1254010464313209586, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=EN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China), AuthorCompanyExt(id=1254010464342569715, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=CN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=国防科技大学电子对抗学院，安徽　合肥　230037)])]), Author(id=1254010466091594496, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, orderNo=1, firstName=null, middleName=null, lastName=null, nameCn=null, orcid=null, stid=null, country=null, authorPic=null, dead=0, email=shifan17@nudt.edu.cn, emailSecond=null, emailThird=null, correspondingAuthor=0, authorType=1, ext={EN=AuthorExt(id=1254010466183869188, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010466091594496, language=EN, stringName=Fan SHI, firstName=Fan, middleName=null, lastName=SHI, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China, bio=null, bioImg=null, bioContent=null, aboutCorrespAuthor=null), CN=AuthorExt(id=1254010466292921094, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010466091594496, language=CN, stringName=施凡, firstName=null, middleName=null, lastName=null, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=国防科技大学电子对抗学院，安徽　合肥　230037, bio={"img":"zD1+mx18Qk5EE0ZGhAVoiw==","content":"

施凡　男，1983年生，博士，教授，研究方向为网络空间测绘和网络空间测量 E-mail:

"}, bioImg=zD1+mx18Qk5EE0ZGhAVoiw==, bioContent=

施凡　男，1983年生，博士，教授，研究方向为网络空间测绘和网络空间测量 E-mail:

, aboutCorrespAuthor=null)}, companyList=[AuthorCompany(id=1254010464292238065, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, xref=null, ext=[AuthorCompanyExt(id=1254010464313209586, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=EN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China), AuthorCompanyExt(id=1254010464342569715, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=CN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=国防科技大学电子对抗学院，安徽　合肥　230037)])]), Author(id=1254010466389390090, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, orderNo=2, firstName=null, middleName=null, lastName=null, nameCn=null, orcid=null, stid=null, country=null, authorPic=null, dead=0, email=xuchengxi@nudt.edu.cn, emailSecond=null, emailThird=null, correspondingAuthor=0, authorType=1, ext={EN=AuthorExt(id=1254010466481664781, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010466389390090, language=EN, stringName=Chengxi XU, firstName=Chengxi, middleName=null, lastName=XU, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China, bio=null, bioImg=null, bioContent=null, aboutCorrespAuthor=null), CN=AuthorExt(id=1254010466569745167, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010466389390090, language=CN, stringName=许成喜, firstName=null, middleName=null, lastName=null, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=国防科技大学电子对抗学院，安徽　合肥　230037, bio={"img":"myQLgcl3oqhPaDBAPd6x1A==","content":"

许成喜　男，1989年生，博士，副教授，研究方向为互联网基础设施安全和网络空间测绘 E-mail:

"}, bioImg=myQLgcl3oqhPaDBAPd6x1A==, bioContent=

许成喜　男，1989年生，博士，副教授，研究方向为互联网基础设施安全和网络空间测绘 E-mail:

, aboutCorrespAuthor=null)}, companyList=[AuthorCompany(id=1254010464292238065, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, xref=null, ext=[AuthorCompanyExt(id=1254010464313209586, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=EN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China), AuthorCompanyExt(id=1254010464342569715, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=CN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=国防科技大学电子对抗学院，安徽　合肥　230037)])]), Author(id=1254010466649436947, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, orderNo=3, firstName=null, middleName=null, lastName=null, nameCn=null, orcid=null, stid=null, country=null, authorPic=null, dead=0, email=dawn1ight@foxmail.com, emailSecond=null, emailThird=null, correspondingAuthor=0, authorType=1, ext={EN=AuthorExt(id=1254010466724934422, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010466649436947, language=EN, stringName=Jiancheng ZHANG, firstName=Jiancheng, middleName=null, lastName=ZHANG, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China, bio=null, bioImg=null, bioContent=null, aboutCorrespAuthor=null), CN=AuthorExt(id=1254010466833986329, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010466649436947, language=CN, stringName=章建成, firstName=null, middleName=null, lastName=null, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=国防科技大学电子对抗学院，安徽　合肥　230037, bio={"img":"rrguR7rvtfU9s5XMP2rA3A==","content":"

章建成　男，2004年生，硕士研究生，研究方向为网络空间测绘 E-mail:

"}, bioImg=rrguR7rvtfU9s5XMP2rA3A==, bioContent=

章建成　男，2004年生，硕士研究生，研究方向为网络空间测绘 E-mail:

, aboutCorrespAuthor=null)}, companyList=[AuthorCompany(id=1254010464292238065, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, xref=null, ext=[AuthorCompanyExt(id=1254010464313209586, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=EN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China), AuthorCompanyExt(id=1254010464342569715, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=CN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=国防科技大学电子对抗学院，安徽　合肥　230037)])]), Author(id=1254010466901095196, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, orderNo=4, firstName=null, middleName=null, lastName=null, nameCn=null, orcid=null, stid=null, country=null, authorPic=null, dead=0, email=18980437826@163.com, emailSecond=null, emailThird=null, correspondingAuthor=0, authorType=1, ext={EN=AuthorExt(id=1254010466984981279, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010466901095196, language=EN, stringName=Mingyi GE, firstName=Mingyi, middleName=null, lastName=GE, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China, bio=null, bioImg=null, bioContent=null, aboutCorrespAuthor=null), CN=AuthorExt(id=1254010467106616098, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, authorId=1254010466901095196, language=CN, stringName=葛明仪, firstName=null, middleName=null, lastName=null, prefix=null, suffix=null, authorComment=null, nameInitials=null, affiliation=null, department=null, xref=null, address=国防科技大学电子对抗学院，安徽　合肥　230037, bio={"img":"1tqevyNYbd4irJcItAhfAg==","content":"

葛明仪女，2003年生，硕士研究生，研究方向为网络空间测绘 E-mail:

"}, bioImg=1tqevyNYbd4irJcItAhfAg==, bioContent=

葛明仪女，2003年生，硕士研究生，研究方向为网络空间测绘 E-mail:

, aboutCorrespAuthor=null)}, companyList=[AuthorCompany(id=1254010464292238065, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, xref=null, ext=[AuthorCompanyExt(id=1254010464313209586, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=EN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China), AuthorCompanyExt(id=1254010464342569715, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=CN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=国防科技大学电子对抗学院，安徽　合肥　230037)])])], keywords=[Keyword(id=1254010467203085092, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, orderNo=1, keyword=IoT), Keyword(id=1254010467278582566, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, orderNo=2, keyword=device identification), Keyword(id=1254010467387634473, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, orderNo=3, keyword=LLM), Keyword(id=1254010467458937643, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, orderNo=4, keyword=packet-level traffic semantic features), Keyword(id=1254010467584766766, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, orderNo=1, keyword=物联网), Keyword(id=1254010467710595889, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, orderNo=2, keyword=设备识别), Keyword(id=1254010467781899059, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, orderNo=3, keyword=大语言模型), Keyword(id=1254010467869979445, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, orderNo=4, keyword=分组级流量语义特征)], refs=[Reference(id=1254010476250198958, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2025-07-01, volume=null, issue=null, pageStart=null, pageEnd=null, url=null, language=null, rfNumber=[1], rfOrder=0, authorNames=ROSEN M, journalName=null, refType=null, unstructuredReference=ROSEN M. Driving the digital agenda requires strategic architecture[EB/OL].(2015-04-22)[2025-07-01]. https://idc-cema.com/dwn/SF_177701., articleTitle=Driving the digital agenda requires strategic architecture, refAbstract=null), Reference(id=1254010476329890736, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2025-07-01, volume=null, issue=null, pageStart=null, pageEnd=null, url=null, language=null, rfNumber=[2], rfOrder=1, authorNames=FORTUNE BUSINESS INSIGHTS, journalName=null, refType=null, unstructuredReference=FORTUNE BUSINESS INSIGHTS.IoT market size, growth:IoT industry report 2026[EB/OL].(2019-01-01)[2025-07-01].https://www.fortunebusinessinsights.com/industry-reports/internet-of-things-iot-market-100307., articleTitle=IoT market size, growth:IoT industry report 2026, refAbstract=null), Reference(id=1254010476417971122, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2022, volume=10, issue=null, pageStart=18352, pageEnd=18369, url=null, language=null, rfNumber=[3], rfOrder=2, authorNames=ALLIFANN M, ZUALKERNAN I A, journalName=IEEE Access, refType=null, unstructuredReference=ALLIFANN M, ZUALKERNAN I A. Ranking security of IoT-based smart home consumer devices[J]. IEEE Access,2022, 10: 18352-18369., articleTitle=Ranking security of IoT-based smart home consumer devices, refAbstract=null), Reference(id=1254010476497662900, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2020, volume=32, issue=null, pageStart=300926, pageEnd=null, url=null, language=null, rfNumber=[4], rfOrder=3, authorNames=ZHANG X L, UPTON O, BEEBE N L, journalName=Forensic Science International: Digital Investigation, refType=null, unstructuredReference=ZHANG X L, UPTON O, BEEBE N L, et al. IoT botnet forensics: a comprehensive digital forensic case study on mirai botnet servers[J]. Forensic Science International: Digital Investigation,2020,32:300926., articleTitle=IoT botnet forensics: a comprehensive digital forensic case study on mirai botnet servers, refAbstract=null), Reference(id=1254010476577354677, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2025, volume=21, issue=5, pageStart=3541, pageEnd=3554, url=null, language=null, rfNumber=[5], rfOrder=4, authorNames=SHENG C, ZHOU W, HAN Q-L, journalName=IEEE Transactions on Industrial Informatics, refType=null, unstructuredReference=SHENG C, ZHOU W, HAN Q-L,et al. Network traffic fingerprinting for IIoT device identification: a survey[J].IEEE Transactions on Industrial Informatics, 2025, 21(5): 3541-3554., articleTitle=Network traffic fingerprinting for IIoT device identification: a survey, refAbstract=null), Reference(id=1254010476648657847, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2021, volume=14, issue=6, pageStart=3674, pageEnd=3687, url=null, language=null, rfNumber=[6], rfOrder=5, authorNames=WU H, WU Q Y, GUANG C, journalName=Peer-to-Peer Networking and Applications, refType=null, unstructuredReference=WU H,WU Q Y,GUANG C,et al.SFIM:identify user behavior based on stable features[J]. Peer-to-Peer Networking and Applications,2021,14(6):3674-3687., articleTitle=SFIM:identify user behavior based on stable features, refAbstract=null), Reference(id=1254010476787069881, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2025-07-01, volume=null, issue=null, pageStart=null, pageEnd=null, url=null, language=null, rfNumber=[7], rfOrder=6, authorNames=HU E, SHEN Y L, WALLIS P, journalName=null, refType=null, unstructuredReference=HU E, SHEN Y L, WALLIS P,et al. LoRA: low-rank adaptation of large Language models[EB/OL].[2025-07-01].https://arxiv.org/pdf/2106.09685v1/1000., articleTitle=LoRA: low-rank adaptation of large Language models, refAbstract=null), Reference(id=1254010476879344571, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2024, volume=35, issue=1, pageStart=288, pageEnd=308, url=null, language=null, rfNumber=[8], rfOrder=7, authorNames=樊琳娜, 李城龙, 吴毅超, journalName=软件学报, refType=null, unstructuredReference=樊琳娜,李城龙,吴毅超,等.物联网设备识别及异常检测研究综述[J].软件学报,2024,35(1): 288-308., articleTitle=物联网设备识别及异常检测研究综述, refAbstract=null), Reference(id=1254010476946453437, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2024, volume=35, issue=1, pageStart=288, pageEnd=308, url=null, language=null, rfNumber=[8], rfOrder=8, authorNames=FAN Linna, LI Chenglong, WU Yichao, journalName=Journal of Software, refType=null, unstructuredReference=FAN Linna, LI Chenglong, WU Yichao, et al. Survey on IoT device identification and anomaly detection[J]. Journal of Software,2024,35(1): 288-308.(in Chinese), articleTitle=Survey on IoT device identification and anomaly detection, refAbstract=null), Reference(id=1254010477026145215, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2008, volume=null, issue=null, pageStart=null, pageEnd=null, url=null, language=null, rfNumber=[9], rfOrder=9, authorNames=STEINWART I, CHRISTMANN A, journalName=Support vector machines, refType=null, unstructuredReference=STEINWART I,CHRISTMANN A. Support vector machines[M]. New York:Springer, 2008., articleTitle=null, refAbstract=null), Reference(id=1254010477126808513, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2016, volume=null, issue=null, pageStart=785, pageEnd=794, url=null, language=null, rfNumber=[10], rfOrder=10, authorNames=CHEN T Q, GUESTRIN C, journalName=null, refType=null, unstructuredReference=CHEN T Q, GUESTRIN C. XGBoost: a scalable tree boosting system[C]//Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. San Francisco:ACM, 2016:785-794., articleTitle=XGBoost: a scalable tree boosting system, refAbstract=null), Reference(id=1254010477202305987, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2019, volume=null, issue=null, pageStart=1255, pageEnd=1259, url=null, language=null, rfNumber=[11], rfOrder=11, authorNames=TAUNK K, DE S, VERMA S, journalName=null, refType=null, unstructuredReference=TAUNK K, DE S, VERMA S, et al. A brief review of nearest neighbor algorithm for learning and classification[C]//Proceedings of 2019 International Conference on Intelligent Computing and Control Systems.Madurai:IEEE, 2019:1255-1259., articleTitle=A brief review of nearest neighbor algorithm for learning and classification, refAbstract=null), Reference(id=1254010477298774980, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2025, volume=204, issue=null, pageStart=111041, pageEnd=null, url=null, language=null, rfNumber=[12], rfOrder=12, authorNames=RAHMAN M M, BOUHAFS F, HOSEINI S A, journalName=Computers& Industrial Engineering, refType=null, unstructuredReference=RAHMAN M M,BOUHAFS F, HOSEINI S A,et al. UNSW HomeNet: a network traffic flow dataset for AI-based smart home device classification[J]. Computers& Industrial Engineering,2025,204:111041., articleTitle=UNSW HomeNet: a network traffic flow dataset for AI-based smart home device classification, refAbstract=null), Reference(id=1254010477370078149, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2022, volume=9, issue=2, pageStart=989, pageEnd=1008, url=null, language=null, rfNumber=[13], rfOrder=13, authorNames=KUMAR R, SWARNKAR M, SINGAL G, journalName=IEEE Internet of Things Journal, refType=null, unstructuredReference=KUMAR R,SWARNKAR M, SINGAL G,et al. IoT network traffic classification using machine learning algorithms: an experimental analysis[J]. IEEE Internet of Things Journal,2022,9(2): 989-1008., articleTitle=IoT network traffic classification using machine learning algorithms: an experimental analysis, refAbstract=null), Reference(id=1254010477453964230, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2023, volume=null, issue=null, pageStart=353, pageEnd=357, url=null, language=null, rfNumber=[14], rfOrder=14, authorNames=TAKASAKI C, KORIKAWA T, HATTORI K, journalName=null, refType=null, unstructuredReference=TAKASAKI C, KORIKAWA T,HATTORI K,et al. Traffic behavior-based device type classification[C]//Proceedings of 2023 International Conference on Computing,Networking and Communications.Honolulu:IEEE,2023: 353-357., articleTitle=Traffic behavior-based device type classification, refAbstract=null), Reference(id=1254010477525267399, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2024, volume=24, issue=8, pageStart=1277, pageEnd=1290, url=null, language=null, rfNumber=[15], rfOrder=15, authorNames=邢长友, 王梓澎, 张国敏, journalName=信息网络安全, refType=null, unstructuredReference=邢长友,王梓澎,张国敏,等.基于预训练Transformers的物联网设备识别方法[J].信息网络安全,2024, 24(8):1277-1290., articleTitle=基于预训练Transformers的物联网设备识别方法, refAbstract=null), Reference(id=1254010478695478217, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2024, volume=24, issue=8, pageStart=1277, pageEnd=1290, url=null, language=null, rfNumber=[15], rfOrder=16, authorNames=XING Changyou, WANG Zipeng, ZHANG Guomin, journalName=Netinfo Security, refType=null, unstructuredReference=XING Changyou,WANG Zipeng,ZHANG Guomin, et al. IoT device identification method based on pre-trained Transformers[J]. Netinfo Security, 2024, 24(8): 1277-1290.(in Chinese), articleTitle=IoT device identification method based on pre-trained Transformers, refAbstract=null), Reference(id=1254010479215571915, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2024, volume=null, issue=null, pageStart=297, pageEnd=308, url=null, language=null, rfNumber=[16], rfOrder=17, authorNames=MORALES G, ROMIT F T, BIENEK-PARRISH A, journalName=null, refType=null, unstructuredReference=MORALES G, ROMIT F T,BIENEK-PARRISH A, et al. IoT device classification using link-level features for traditional machine learning and large language models[C]//Proceedings of the 10th International Conference on Information Systems Security and Privacy.[S.l.: s.n.],2024:297-308., articleTitle=IoT device classification using link-level features for traditional machine learning and large language models, refAbstract=null), Reference(id=1254010479307846605, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2025-07-01, volume=null, issue=null, pageStart=null, pageEnd=null, url=null, language=null, rfNumber=[17], rfOrder=18, authorNames=COMBS G, journalName=null, refType=null, unstructuredReference=COMBS G. Wireshark and Tshark network protocol analyzer[EB/OL].[2025-07-01].https://www.wireshark.org., articleTitle=Wireshark and Tshark network protocol analyzer, refAbstract=null), Reference(id=1254010479379149775, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2025-07-01, volume=null, issue=null, pageStart=null, pageEnd=null, url=null, language=null, rfNumber=[18], rfOrder=19, authorNames=ZENG A H, XU B, WANG B W, journalName=null, refType=null, unstructuredReference=ZENG A H, XU B, WANG B W, et al. ChatGLM: a family of large language models from GLM-130B to GLM-4 all tools[EB/OL].[2025-07-01].https://arxiv.org/abs/2406.12793., articleTitle=ChatGLM: a family of large language models from GLM-130B to GLM-4 all tools, refAbstract=null), Reference(id=1254010479458841553, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2017, volume=null, issue=null, pageStart=2177, pageEnd=2184, url=null, language=null, rfNumber=[19], rfOrder=20, authorNames=MIETTINEN M, MARCHAL S, HAFEEZ N, journalName=null, refType=null, unstructuredReference=MIETTINEN M, MARCHAL S, HAFEEZ N,et al. IoT sentinel demo:automated device-type identification for security enforcement in IoT[C]//Proceedings of the 37th International Conference on Distributed Computing Systems. Atlanta:IEEE,2017:2177-2184., articleTitle=IoT sentinel demo:automated device-type identification for security enforcement in IoT, refAbstract=null), Reference(id=1254010479572087763, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2019, volume=18, issue=8, pageStart=1745, pageEnd=1759, url=null, language=null, rfNumber=[20], rfOrder=21, authorNames=SIVANATHAN A, GHARAKHEILI H H, LOI F, journalName=IEEE Transactions on Mobile Computing, refType=null, unstructuredReference=SIVANATHAN A, GHARAKHEILI H H, LOI F, et al. Classifying IoT devices in smart environments using network traffic characteristics[J].IEEE Transactions on Mobile Computing,2019,18(8): 1745-1759., articleTitle=Classifying IoT devices in smart environments using network traffic characteristics, refAbstract=null), Reference(id=1254010479706305492, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2022, volume=null, issue=null, pageStart=1, pageEnd=11, url=null, language=null, rfNumber=[21], rfOrder=22, authorNames=DADKHAH S, MAHDIKHANI H, DANSO P K, journalName=null, refType=null, unstructuredReference=DADKHAH S,MAHDIKHANI H,DANSO P K,et al. Towards the development of a realistic multidimensional IoT profiling dataset[C]//Proceedings of the 19th Annual International Conference on Privacy, Security& Trust.Fredericton:IEEE,2022:1-11., articleTitle=Towards the development of a realistic multidimensional IoT profiling dataset, refAbstract=null), Reference(id=1254010479785997270, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2023, volume=23, issue=13, pageStart=5941, pageEnd=null, url=null, language=null, rfNumber=[22], rfOrder=23, authorNames=NETO E C P, DADKHAH S, FERREIRA R, journalName=Sensors, refType=null, unstructuredReference=NETO E C P, DADKHAH S, FERREIRA R, et al. CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment[J]. Sensors, 2023,23(13):5941., articleTitle=CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment, refAbstract=null), Reference(id=1254010479857300440, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2025-07-01, volume=null, issue=null, pageStart=null, pageEnd=null, url=null, language=null, rfNumber=[23], rfOrder=24, authorNames=The Wireshark Project, journalName=null, refType=null, unstructuredReference=The Wireshark Project. Wireshark user's guide[EB/OL].[2025-07-01].https://www.wireshark.org/docs/., articleTitle=Wireshark user's guide, refAbstract=null), Reference(id=1254010479920215002, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2019, volume=null, issue=null, pageStart=103, pageEnd=111, url=null, language=null, rfNumber=[24], rfOrder=25, authorNames=HAMAD S A, ZHANG W E, SHENG Q Z, journalName=null, refType=null, unstructuredReference=HAMAD S A, ZHANG W E, SHENG Q Z, et al. IoT device identification via network-flow based fingerprinting and learning[C]//Proceedings of the 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications. Rotorua: IEEE, 2019: 103-111., articleTitle=IoT device identification via network-flow based fingerprinting and learning, refAbstract=null), Reference(id=1254010479991518172, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, doi=null, pmid=null, pmcid=null, year=2022, volume=9, issue=23, pageStart=23741, pageEnd=23749, url=null, language=null, rfNumber=[25], rfOrder=26, authorNames=KOSTAS K, JUST M, LONES M A, journalName=IEEE Internet of Things Journal, refType=null, unstructuredReference=KOSTAS K, JUST M, LONES M A, et al. IoTDevID:a behavior-based device identification method for the IoT[J].IEEE Internet of Things Journal,2022, 9(23):23741-23749., articleTitle=IoTDevID:a behavior-based device identification method for the IoT, refAbstract=null)], funds=null, companyList=[AuthorCompany(id=1254010464292238065, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, xref=null, ext=[AuthorCompanyExt(id=1254010464313209586, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=EN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China), AuthorCompanyExt(id=1254010464342569715, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, companyId=1254010464292238065, language=CN, country=null, province=null, city=null, postcode=null, companyName=null, departmentName=null, remark=国防科技大学电子对抗学院，安徽　合肥　230037)])], figs=[ArticleFig(id=1254010468012585782, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.1, caption=The application scenarios of the IoT device identification model, figureFileSmall=fBlu9U3gUNkZqs8KeZgA1Q==, figureFileBig=qPY4o13HEcK3D1tV4P4aWA==, tableContent=null), ArticleFig(id=1254010468067111735, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图1, caption=IoT设备识别模型的使用场景, figureFileSmall=fBlu9U3gUNkZqs8KeZgA1Q==, figureFileBig=qPY4o13HEcK3D1tV4P4aWA==, tableContent=null), ArticleFig(id=1254010468297798462, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.2, caption=The framework of the method in this article, figureFileSmall=YhDv9O05k9VF+TlH/aufpg==, figureFileBig=18KYyTS6+prNNbFDC7MHOA==, tableContent=null), ArticleFig(id=1254010468377490239, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图2, caption=本文方法框架, figureFileSmall=YhDv9O05k9VF+TlH/aufpg==, figureFileBig=18KYyTS6+prNNbFDC7MHOA==, tableContent=null), ArticleFig(id=1254010468465570626, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.3, caption=Group-level traffic semantic feature field classification, figureFileSmall=nvqD0KFUR7WOjgi2fiWuLQ==, figureFileBig=UyVs3+atTmUuiqnY+Q38fA==, tableContent=null), ArticleFig(id=1254010468583011142, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图3, caption=分组级流量语义特征字段分类, figureFileSmall=nvqD0KFUR7WOjgi2fiWuLQ==, figureFileBig=UyVs3+atTmUuiqnY+Q38fA==, tableContent=null), ArticleFig(id=1254010468662702922, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.4, caption=Device detection tuning data example, figureFileSmall=kgVluilEACOGJ4TBEAvg9w==, figureFileBig=foStDuzUJHcU0hGSwFLtAA==, tableContent=null), ArticleFig(id=1254010470239761228, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图4, caption=设备检测调优数据示例, figureFileSmall=kgVluilEACOGJ4TBEAvg9w==, figureFileBig=foStDuzUJHcU0hGSwFLtAA==, tableContent=null), ArticleFig(id=1254010470306870094, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.5, caption=Scalable adaptation based on efficient fine-tuning of parameters, figureFileSmall=HLiLl7pPngsR0DoJUKn90g==, figureFileBig=Wg16MwlY+IOa9tbCjRUWwg==, tableContent=null), ArticleFig(id=1254010470373978961, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图5, caption=基于参数高效微调的可拓展性适配, figureFileSmall=HLiLl7pPngsR0DoJUKn90g==, figureFileBig=Wg16MwlY+IOa9tbCjRUWwg==, tableContent=null), ArticleFig(id=1254010470453670739, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.6, caption=Aalto dataset distribution, figureFileSmall=CQm3DzxtYsoBdHHWY3/vDw==, figureFileBig=DwF2G3zSan2B7v4YUZxerg==, tableContent=null), ArticleFig(id=1254010470550139733, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图6, caption=Aalto数据集分布, figureFileSmall=CQm3DzxtYsoBdHHWY3/vDw==, figureFileBig=DwF2G3zSan2B7v4YUZxerg==, tableContent=null), ArticleFig(id=1254010470638220119, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.7, caption=UNSW dataset distribution, figureFileSmall=qWC2CGFKfbVv5qLID8veiQ==, figureFileBig=jtP5VsfORq4zB+39yOWVfg==, tableContent=null), ArticleFig(id=1254010470780826459, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图7, caption=UNSW数据集分布, figureFileSmall=qWC2CGFKfbVv5qLID8veiQ==, figureFileBig=jtP5VsfORq4zB+39yOWVfg==, tableContent=null), ArticleFig(id=1254010470885684062, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.8, caption=CIC IoT dataset distribution, figureFileSmall=UX5x/9HyOyHFpScA6/wMbA==, figureFileBig=z1pglukpcTGKNQgVEbkd4A==, tableContent=null), ArticleFig(id=1254010470973764447, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图8, caption=CIC IoT数据集分布, figureFileSmall=UX5x/9HyOyHFpScA6/wMbA==, figureFileBig=z1pglukpcTGKNQgVEbkd4A==, tableContent=null), ArticleFig(id=1254010471074427746, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.9, caption=A comparative analysis of the influence of sequence length and rank value on model accuracy, figureFileSmall=D8cmMfhqxcwha16ZJHVjFg==, figureFileBig=Uceozg0QnnPAVpQBGKDlNg==, tableContent=null), ArticleFig(id=1254010471141536612, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图9, caption=序列长度与秩值对模型准确率影响的对比分析, figureFileSmall=D8cmMfhqxcwha16ZJHVjFg==, figureFileBig=Uceozg0QnnPAVpQBGKDlNg==, tableContent=null), ArticleFig(id=1254010471221228390, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.10, caption=The model classification confusion matrix(Aalto) in this article, figureFileSmall=hldwbRjsl9MMlHyH/4GSjg==, figureFileBig=Et1FS3dDL0/mbYIjOh4T4A==, tableContent=null), ArticleFig(id=1254010471292531560, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图10, caption=本文模型分类混淆矩阵（Aalto）, figureFileSmall=hldwbRjsl9MMlHyH/4GSjg==, figureFileBig=Et1FS3dDL0/mbYIjOh4T4A==, tableContent=null), ArticleFig(id=1254010471380611946, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.11, caption=The model classification confusion matrix(UNSW) in this paper, figureFileSmall=FU5mih8Ow/ZQDo7nHMB0EQ==, figureFileBig=SAtmkKZKl9J8/YaYACoLTg==, tableContent=null), ArticleFig(id=1254010471468692333, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图11, caption=本文模型分类混淆矩阵（UNSW）, figureFileSmall=FU5mih8Ow/ZQDo7nHMB0EQ==, figureFileBig=SAtmkKZKl9J8/YaYACoLTg==, tableContent=null), ArticleFig(id=1254010471560967025, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.12, caption=The model classification confusion matrix(CIC IoT) in this paper, figureFileSmall=qW7kbdl/eZ7iB/F7wcEWBA==, figureFileBig=mLMC6olrBFanbZ9HIbY8Hg==, tableContent=null), ArticleFig(id=1254010471661630322, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图12, caption=本文模型分类混淆矩阵（CIC IoT）, figureFileSmall=qW7kbdl/eZ7iB/F7wcEWBA==, figureFileBig=mLMC6olrBFanbZ9HIbY8Hg==, tableContent=null), ArticleFig(id=1254010471812625270, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.13, caption=Confusion matrix of model classification in this paper(small sample), figureFileSmall=elg71rCuABuORWdiixGURw==, figureFileBig=rTknG6oTS7cfHYMgkVnJIg==, tableContent=null), ArticleFig(id=1254010471888122743, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图13, caption=本文模型分类混淆矩阵（小样本）, figureFileSmall=elg71rCuABuORWdiixGURw==, figureFileBig=rTknG6oTS7cfHYMgkVnJIg==, tableContent=null), ArticleFig(id=1254010471963620216, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.14, caption=Comparison of classification performance before and after domain adaptation of large models, figureFileSmall=3kd8NMzxxyqEa3fqNqDDIA==, figureFileBig=Yctm3wmb/SSpITLn52y0zg==, tableContent=null), ArticleFig(id=1254010472060089212, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图14, caption=大模型领域适配前后的分类性能对比, figureFileSmall=3kd8NMzxxyqEa3fqNqDDIA==, figureFileBig=Yctm3wmb/SSpITLn52y0zg==, tableContent=null), ArticleFig(id=1254010472135586686, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.15, caption=A comparison chart of the performance of the original and improved tokenizers, figureFileSmall=YQs5u1QWMGY7ETjEzZ1E2Q==, figureFileBig=2FYj9Kv6mm6IVnKi5xA2UQ==, tableContent=null), ArticleFig(id=1254010472202695552, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图15, caption=原始与改进分词器性能对比图, figureFileSmall=YQs5u1QWMGY7ETjEzZ1E2Q==, figureFileBig=2FYj9Kv6mm6IVnKi5xA2UQ==, tableContent=null), ArticleFig(id=1254010472404022146, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Fig.16, caption=A schematic diagram comparing the interception effects under different data payload lengths, figureFileSmall=Q1ttdaJjBUhXZUGJIi9F1A==, figureFileBig=De2/u67LW4z3A49YcC8KBg==, tableContent=null), ArticleFig(id=1254010472508879748, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=图16, caption=不同数据载荷长度下的截取效果对比图, figureFileSmall=Q1ttdaJjBUhXZUGJIi9F1A==, figureFileBig=De2/u67LW4z3A49YcC8KBg==, tableContent=null), ArticleFig(id=1254010472596960134, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=null, caption=null, figureFileSmall=null, figureFileBig=null, tableContent=
), ArticleFig(id=1254010472718594951, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=算法1, caption=

基于原始流量的分组级语义信息提取算法

, figureFileSmall=null, figureFileBig=null, tableContent=
), ArticleFig(id=1254010472819258248, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.1, caption=

Comparison of word segmentation between a specific word segitter and the default word segitter

, figureFileSmall=null, figureFileBig=null, tableContent=
默认分词结果（Tokenlength:763.25）特定分词结果（Tokenlength:687.38）
’＜’，’packet’，’＞:’，’_frame’，’.enc’，’ap _type’，’:’，’_’，’1’，’，’，’_frame’，’.time’，’:’，’_0ct’，’_’，’_’，’9’，’，’，’_ ’，’ 2016’，’ _ ’，’ 20’，’:’，’ 54’，’:’，’ 45’，’.’，’5’，’96’，’03’，’ 8’，’000’，’_CST’，’，’，’_frame’，’. offset _shift’，’:’，’_’，’0’，’.’，’ 000’，’000’，’000’，’，’，…[更多分词内容]’＜packet＞’，’:’，’_’，’ frame.encap_type’，’:’，’_’，’1’，’，’，’_’，’frame. time’，’:’，’_0ct’，’_’，’_ ’，’ 9’，’，’，’ _ ’，’ 2016’，’_’，’20’，’:’，’ 54’，’:’，’45’，’.’，’5’，’ 96’，’03’，’8’，’000’，’_CST’，’，’，’_’，’frame. offset_shift’，’:’，’_’，’ 0’，’.’，’000’，’000’，’ 000’，’，’，…[更多分词内容]
), ArticleFig(id=1254010472886367114, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表1, caption=

特定分词器与默认分词器分词对比

, figureFileSmall=null, figureFileBig=null, tableContent=
默认分词结果（Tokenlength:763.25）特定分词结果（Tokenlength:687.38）
’＜’，’packet’，’＞:’，’_frame’，’.enc’，’ap _type’，’:’，’_’，’1’，’，’，’_frame’，’.time’，’:’，’_0ct’，’_’，’_’，’9’，’，’，’_ ’，’ 2016’，’ _ ’，’ 20’，’:’，’ 54’，’:’，’ 45’，’.’，’5’，’96’，’03’，’ 8’，’000’，’_CST’，’，’，’_frame’，’. offset _shift’，’:’，’_’，’0’，’.’，’ 000’，’000’，’000’，’，’，…[更多分词内容]’＜packet＞’，’:’，’_’，’ frame.encap_type’，’:’，’_’，’1’，’，’，’_’，’frame. time’，’:’，’_0ct’，’_’，’_ ’，’ 9’，’，’，’ _ ’，’ 2016’，’_’，’20’，’:’，’ 54’，’:’，’45’，’.’，’5’，’ 96’，’03’，’8’，’000’，’_CST’，’，’，’_’，’frame. offset_shift’，’:’，’_’，’ 0’，’.’，’000’，’000’，’ 000’，’，’，…[更多分词内容]
), ArticleFig(id=1254010472961864588, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.2, caption=

Aalto data classification and recognition results

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
Aria99.2199.210.9921
D-Link Sensor99.961000.9998
Edimax Cam21001001.0000
Ednet Gateway1001001.0000
Lightify1001001.0000
WeMo Insight Switch21001001.0000
WeMo Insight Switch1001001.0000
Withings1001001.0000
D-Link Cam1001001.0000
D-Link Siren1001001.0000
Edimax Plug 1101W1001001.0000
Home Matic Plug1001001.0000
MAXGateway1001001.0000
Smarter Coffee1001001.0000
D-Link DayCam1001001.0000
D-Link Switch1001001.0000
Edimax Plug 2101W1001001.0000
Hue Bridge10099.970.9998
TP-Link Plug HS1001001001.0000
WeMo Link1001001.0000
D-Link Door Sensor1001001.0000
D-Link Water Sensor1001001.0000
Ednet Cam11001001.0000
Hue Switch1001001.0000
TP-Link Plug HS1101001001.0000
WeMo Switch21001001.0000
D-Link Home Hub1001001.0000
EdimaxCam11001001.0000
Ednet Cam21001001.0000
iKettle21001001.0000
WeMo Switch1001001.0000
), ArticleFig(id=1254010473062527886, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表2, caption=

Aalto数据分类识别结果

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
Aria99.2199.210.9921
D-Link Sensor99.961000.9998
Edimax Cam21001001.0000
Ednet Gateway1001001.0000
Lightify1001001.0000
WeMo Insight Switch21001001.0000
WeMo Insight Switch1001001.0000
Withings1001001.0000
D-Link Cam1001001.0000
D-Link Siren1001001.0000
Edimax Plug 1101W1001001.0000
Home Matic Plug1001001.0000
MAXGateway1001001.0000
Smarter Coffee1001001.0000
D-Link DayCam1001001.0000
D-Link Switch1001001.0000
Edimax Plug 2101W1001001.0000
Hue Bridge10099.970.9998
TP-Link Plug HS1001001001.0000
WeMo Link1001001.0000
D-Link Door Sensor1001001.0000
D-Link Water Sensor1001001.0000
Ednet Cam11001001.0000
Hue Switch1001001.0000
TP-Link Plug HS1101001001.0000
WeMo Switch21001001.0000
D-Link Home Hub1001001.0000
EdimaxCam11001001.0000
Ednet Cam21001001.0000
iKettle21001001.0000
WeMo Switch1001001.0000
), ArticleFig(id=1254010474719277968, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.3, caption=

UNSW data classification and identification results

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT99.3599.120.9924
Amazon Echo95.331000.9761
Belkin Wemo Motion Sensor98.8798.930.9890
Blipcare Blood Pressure Meter1001001.0000
Dropcam1001001.0000
HP Printer1001001.0000
iHome97.671000.9882
Insteon Camera10096.150.9804
Light Bulbs LiFX Smart Bulb99.971000.9998
Belkin Wemo Switch98.9398.830.9888
NEST Protect Smoke Alarm1001001.0000
Netatmo Weather Station99.9799.970.9997
Netatmo Welcome10099.870.9993
PIX STAR Photo Frame1001001.0000
Samsung Smart Cam99.4099.970.9977
Smart Things10099.970.9998
TP-Link Day Night CloudCamera10099.400.9970
TP-Link Smart Plug10098.980.9949
Triby Speaker1001001.0000
Withings Aura Smart SleepSensor10099.120.9956
Withings Smart BabyMonitor99.401000.9970
Withings Smart Scale99.121000.9956
), ArticleFig(id=1254010474849301393, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表3, caption=

UNSW数据分类识别结果

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT99.3599.120.9924
Amazon Echo95.331000.9761
Belkin Wemo Motion Sensor98.8798.930.9890
Blipcare Blood Pressure Meter1001001.0000
Dropcam1001001.0000
HP Printer1001001.0000
iHome97.671000.9882
Insteon Camera10096.150.9804
Light Bulbs LiFX Smart Bulb99.971000.9998
Belkin Wemo Switch98.9398.830.9888
NEST Protect Smoke Alarm1001001.0000
Netatmo Weather Station99.9799.970.9997
Netatmo Welcome10099.870.9993
PIX STAR Photo Frame1001001.0000
Samsung Smart Cam99.4099.970.9977
Smart Things10099.970.9998
TP-Link Day Night CloudCamera10099.400.9970
TP-Link Smart Plug10098.980.9949
Triby Speaker1001001.0000
Withings Aura Smart SleepSensor10099.120.9956
Withings Smart BabyMonitor99.401000.9970
Withings Smart Scale99.121000.9956
), ArticleFig(id=1254010474954158994, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.4, caption=

Classification and recognition results of CIC IoT hybrid datasets

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
AMCREST WiFi Camera95.661000.9778
AeoTec Smart Home Hub94.5095.000.9475
Amazon Echo Dot 110099.730.9986
Amazon Echo Dot 299.6799.530.9960
Amazon Echo Show10099.270.9963
Amazon Echo Spot10099.400.9970
Amazon Echo Studio10099.870.9994
Amazon Plug10099.700.9985
Arlo Q Indoor Camera99.871000.9994
Arlo Base Station10099.200.9960
Atomi Coffee Maker10099.600.9980
Borun Sichuan AICamera10099.930.9997
Cocoon Smart HVAC Fan10096.840.9839
DCS8000LHA1D Link Mini1001001.0000
Eufy Home Base21001001.0000
Fibaro Home Center Lite10099.930.9997
Globe Lamp ESP B1680C99.8099.730.9977
GoSundBulb99.921000.9996
GoSund Power Strip 199.8799.200.9953
GoSund Power Strip 299.6099.530.9957
GoSund Smart Plug WP2199.6099.600.9960
GoSund Smart Plug WP2299.4099.530.9947
GoSund Smart Plug WP2399.5398.270.9890
GoSund Smart Plug WP3110099.930.9997
GoSund Smart Plug WP321001001.0000
Google Nest Mini Speaker1001001.0000
Govee Smart Humidifier1001001.0000
Harmankardon Speaker10096.330.9813
Heim Vision Camera1001001.0000
Heim Vision Radio Lamp99.9399.400.9966
LG Smart TV10099.800.9990
LIFX Light Bulb10099.870.9994
LampUXRGB10099.920.9996
Levoit Air Purifier1001001.0000
Luohe Cam Dog1001001.0000
Nest Indoor Camera1001001.0000
Netatmo Camera99.8099.930.9987
Netatmo Weather Station10099.730.9986
Philips Hue Bridge10099.270.9963
Raspberry Pi4 2GB97.5999.590.9858
Raspberry Pi4 8GB10099.530.9976
Ring Base Station1001001.0000
SIMCAM1S AMPAKTec99.0698.070.9856
Smart Board1001001.0000
Smart Things Hub95.5094.870.9518
Sonos One Speaker10099.730.9986
TP-Link Tapo Camera10099.400.9970
Teckin Light Strip10099.930.9997
Teckin Plug185.0490.930.8789
Teckin Plug289.9997.730.9370
WeMo Smart Plug11001001.0000
WeMo Smart Plug210099.660.9983
Wyze Camera1001001.0000
Yi Indoor2 Camera10098.230.9911
Yi Indoor Camera99.011000.9950
Yi Outdoor Camera10094.510.9718
Yutron Plug187.8093.600.9061
Yutron Plug298.7790.730.9458
iRobot Roomba1001001.0000
), ArticleFig(id=1254010475042239380, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表4, caption=

CIC IoT混合数据集分类识别结果

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
AMCREST WiFi Camera95.661000.9778
AeoTec Smart Home Hub94.5095.000.9475
Amazon Echo Dot 110099.730.9986
Amazon Echo Dot 299.6799.530.9960
Amazon Echo Show10099.270.9963
Amazon Echo Spot10099.400.9970
Amazon Echo Studio10099.870.9994
Amazon Plug10099.700.9985
Arlo Q Indoor Camera99.871000.9994
Arlo Base Station10099.200.9960
Atomi Coffee Maker10099.600.9980
Borun Sichuan AICamera10099.930.9997
Cocoon Smart HVAC Fan10096.840.9839
DCS8000LHA1D Link Mini1001001.0000
Eufy Home Base21001001.0000
Fibaro Home Center Lite10099.930.9997
Globe Lamp ESP B1680C99.8099.730.9977
GoSundBulb99.921000.9996
GoSund Power Strip 199.8799.200.9953
GoSund Power Strip 299.6099.530.9957
GoSund Smart Plug WP2199.6099.600.9960
GoSund Smart Plug WP2299.4099.530.9947
GoSund Smart Plug WP2399.5398.270.9890
GoSund Smart Plug WP3110099.930.9997
GoSund Smart Plug WP321001001.0000
Google Nest Mini Speaker1001001.0000
Govee Smart Humidifier1001001.0000
Harmankardon Speaker10096.330.9813
Heim Vision Camera1001001.0000
Heim Vision Radio Lamp99.9399.400.9966
LG Smart TV10099.800.9990
LIFX Light Bulb10099.870.9994
LampUXRGB10099.920.9996
Levoit Air Purifier1001001.0000
Luohe Cam Dog1001001.0000
Nest Indoor Camera1001001.0000
Netatmo Camera99.8099.930.9987
Netatmo Weather Station10099.730.9986
Philips Hue Bridge10099.270.9963
Raspberry Pi4 2GB97.5999.590.9858
Raspberry Pi4 8GB10099.530.9976
Ring Base Station1001001.0000
SIMCAM1S AMPAKTec99.0698.070.9856
Smart Board1001001.0000
Smart Things Hub95.5094.870.9518
Sonos One Speaker10099.730.9986
TP-Link Tapo Camera10099.400.9970
Teckin Light Strip10099.930.9997
Teckin Plug185.0490.930.8789
Teckin Plug289.9997.730.9370
WeMo Smart Plug11001001.0000
WeMo Smart Plug210099.660.9983
Wyze Camera1001001.0000
Yi Indoor2 Camera10098.230.9911
Yi Indoor Camera99.011000.9950
Yi Outdoor Camera10094.510.9718
Yutron Plug187.8093.600.9061
Yutron Plug298.7790.730.9458
iRobot Roomba1001001.0000
), ArticleFig(id=1254010475126125462, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.5, caption=

Small sample data classification results(UNSW)

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT96.1999.340.9774
Amazon Echo98.041000.9901
Belkin Wemo Motion Sensor91.5297.870.9459
Blipcare Blood Pressure Meter91.671000.9565
Dropcam10099.840.9992
HP Printer10099.940.9997
iHome99.8793.270.9646
Insteon Camera10097.540.9876
Light Bulbs LiFX SmartBulb99.901000.9995
Belkin Wemo Switch97.5891.230.9430
NEST Protect Smoke Alarm1001001.0000
Netatmo Weather Station99.9395.000.9740
Netatmo Welcome95.2499.930.9753
PIX STAR Photo Frame1001001.0000
Samsung Smart Cam97.941000.9896
Smart Things10099.630.9982
TP-Link Day Night Cloud Camera99.3398.430.9888
TP-Link Smart Plug98.9999.840.9941
Triby Speaker10084.130.9138
Withings Aura Smart Sleep Sensor98.9395.750.9732
Withings Smart Baby Monitor97.4199.230.9832
Withings Smart Scale93.8797.340.9557
), ArticleFig(id=1254010475226788761, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表5, caption=

小样本数据分类结果（UNSW）

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT96.1999.340.9774
Amazon Echo98.041000.9901
Belkin Wemo Motion Sensor91.5297.870.9459
Blipcare Blood Pressure Meter91.671000.9565
Dropcam10099.840.9992
HP Printer10099.940.9997
iHome99.8793.270.9646
Insteon Camera10097.540.9876
Light Bulbs LiFX SmartBulb99.901000.9995
Belkin Wemo Switch97.5891.230.9430
NEST Protect Smoke Alarm1001001.0000
Netatmo Weather Station99.9395.000.9740
Netatmo Welcome95.2499.930.9753
PIX STAR Photo Frame1001001.0000
Samsung Smart Cam97.941000.9896
Smart Things10099.630.9982
TP-Link Day Night Cloud Camera99.3398.430.9888
TP-Link Smart Plug98.9999.840.9941
Triby Speaker10084.130.9138
Withings Aura Smart Sleep Sensor98.9395.750.9732
Withings Smart Baby Monitor97.4199.230.9832
Withings Smart Scale93.8797.340.9557
), ArticleFig(id=1254010475327452057, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.6, caption=

Classification results of environmental change data

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT98.1594.790.9644
Amazon Echo1001001.0000
Belkin Wemo Motion Sensor98.7498.930.9883
Blipcare Blood Pressure Meter1001001.0000
Dropcam99.931000.9997
HP Printer10093.090.9642
iHome10099.820.9991
Insteon Camera99.8097.020.9839
Light Bulbs LiFX Smart Bulb1001001.0000
Belkin Wemo Switch98.9398.800.9887
NEST Protect Smoke Alarm10099.780.9989
Netatmo Weather Station99.9399.770.9985
Netatmo Welcome98.9799.530.9925
PIX STAR Photo Frame1001001.0000
Samsung Smart Cam94.7999.970.9731
Smart Things1001001.0000
TP-Link Day Night CloudCamera99.7699.000.9938
TP-Link Smart Plug10097.740.9886
Triby Speaker99.9399.970.9995
Withings Aura Smart Sleep Sensor99.9299.690.9981
Withings Smart Baby Monitor99.6099.970.9978
Withings Smart Scale1001001.0000
D-Link Door Sensor10098.180.9908
), ArticleFig(id=1254010475436503964, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表6, caption=

环境变化数据分类结果

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT98.1594.790.9644
Amazon Echo1001001.0000
Belkin Wemo Motion Sensor98.7498.930.9883
Blipcare Blood Pressure Meter1001001.0000
Dropcam99.931000.9997
HP Printer10093.090.9642
iHome10099.820.9991
Insteon Camera99.8097.020.9839
Light Bulbs LiFX Smart Bulb1001001.0000
Belkin Wemo Switch98.9398.800.9887
NEST Protect Smoke Alarm10099.780.9989
Netatmo Weather Station99.9399.770.9985
Netatmo Welcome98.9799.530.9925
PIX STAR Photo Frame1001001.0000
Samsung Smart Cam94.7999.970.9731
Smart Things1001001.0000
TP-Link Day Night CloudCamera99.7699.000.9938
TP-Link Smart Plug10097.740.9886
Triby Speaker99.9399.970.9995
Withings Aura Smart Sleep Sensor99.9299.690.9981
Withings Smart Baby Monitor99.6099.970.9978
Withings Smart Scale1001001.0000
D-Link Door Sensor10098.180.9908
), ArticleFig(id=1254010475528778654, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.7, caption=

The classification performance results of IoT device types in a cross-dataset environment

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
Amazon Echo10099.890.9994
Borun Sichuan AI Camera99.931000.9997
Fibaro Home Center Lite10099.870.9993
LIFX Light Bulb1001001.0000
Philips Hue Bridge99.8099.870.9983
TP-Link Tapo Camera10081.870.9003
), ArticleFig(id=1254010475608470432, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表7, caption=

IoT设备类型在跨数据集环境下的分类性能结果

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
Amazon Echo10099.890.9994
Borun Sichuan AI Camera99.931000.9997
Fibaro Home Center Lite10099.870.9993
LIFX Light Bulb1001001.0000
Philips Hue Bridge99.8099.870.9983
TP-Link Tapo Camera10081.870.9003
), ArticleFig(id=1254010475679773602, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.8, caption=

The classification performance results of IoT device types in an encrypted environment

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT99.9599.980.9997
Amazon Echo1001001.0000
Belkin Wemo Motion Sensor96.791000.9837
Blipcare Blood Pressure1001001.0000
Meter Dropcam1001001.0000
HP Printer1001001.0000
iHome1001001.0000
Insteon Camera99.411000.9970
Light Bulbs LiFX Smart Bulb1001001.0000
Netatmo Welcome99.671000.9984
PIX STAR Photo Frame1001001.0000
Smart Things1001001.0000
TP Link Day Night Cloud Camera1001001.0000
TP Link Smar tPlug1001001.0000
Triby Speaker1001001.0000
), ArticleFig(id=1254010475788825508, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表8, caption=

IoT设备类型在加密环境下的分类性能结果

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT99.9599.980.9997
Amazon Echo1001001.0000
Belkin Wemo Motion Sensor96.791000.9837
Blipcare Blood Pressure1001001.0000
Meter Dropcam1001001.0000
HP Printer1001001.0000
iHome1001001.0000
Insteon Camera99.411000.9970
Light Bulbs LiFX Smart Bulb1001001.0000
Netatmo Welcome99.671000.9984
PIX STAR Photo Frame1001001.0000
Smart Things1001001.0000
TP Link Day Night Cloud Camera1001001.0000
TP Link Smar tPlug1001001.0000
Triby Speaker1001001.0000
), ArticleFig(id=1254010475876905894, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.9, caption=

The classification performance evaluation of IoT device types in a hardware identifier forgery environment

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT98.0698.450.9825
Amazon Echo95.2399.200.9718
Belkin Wemo Motion Sensor97.1994.570.9586
Blipcare Blood Pressure Meter1001001.0000
Dropcam99.8798.440.9915
HP Printer97.7899.720.9874
iHome10096.630.9829
Insteon Camera10095.110.9750
Light Bulbs LiFX Smart Bulb99.9799.130.9955
Belkin Wemo Switch95.1097.070.9607
NEST Protect Smoke Alarm94.0498.440.9619
Netatmo Weather Station99.371000.9968
Netatmo Welcome99.8798.870.9936
PIX STAR Photo Frame98.4599.450.9895
Samsung Smart Cam98.9899.800.9939
Smart Things98.8599.970.9940
TP Link Day Night Cloud Camera99.3698.870.9911
TP Link Smart Plug97.6498.060.9785
Triby Speaker99.0499.700.9937
Withings Aura Smart Sleep Sensor99.4298.510.9896
Withings Smart Baby Monitor99.2099.670.9943
Withings Smart Scale99.8597.040.9842
), ArticleFig(id=1254010475973374888, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表9, caption=

IoT设备类型在硬件标识伪造环境下的分类性能评估

, figureFileSmall=null, figureFileBig=null, tableContent=
设备名称精确率/%召回率/%F1值
non-IoT98.0698.450.9825
Amazon Echo95.2399.200.9718
Belkin Wemo Motion Sensor97.1994.570.9586
Blipcare Blood Pressure Meter1001001.0000
Dropcam99.8798.440.9915
HP Printer97.7899.720.9874
iHome10096.630.9829
Insteon Camera10095.110.9750
Light Bulbs LiFX Smart Bulb99.9799.130.9955
Belkin Wemo Switch95.1097.070.9607
NEST Protect Smoke Alarm94.0498.440.9619
Netatmo Weather Station99.371000.9968
Netatmo Welcome99.8798.870.9936
PIX STAR Photo Frame98.4599.450.9895
Samsung Smart Cam98.9899.800.9939
Smart Things98.8599.970.9940
TP Link Day Night Cloud Camera99.3698.870.9911
TP Link Smart Plug97.6498.060.9785
Triby Speaker99.0499.700.9937
Withings Aura Smart Sleep Sensor99.4298.510.9896
Withings Smart Baby Monitor99.2099.670.9943
Withings Smart Scale99.8597.040.9842
), ArticleFig(id=1254010476061455274, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=EN, label=Tab.10, caption=

Comparison of IoT device Identification technologies

, figureFileSmall=null, figureFileBig=null, tableContent=
识别方法特征类型数据集评估指标结果
IoTSentinel数据分组头部字段Aalto准确率81.50%
文献[24]流统计特征AaltoF1值0.9030
IoTDevID数据分组头部字段和有效载荷Aalto准确率83.30%
UNSW准确率94.30%
文献[16]数据分组链路层语义特征UNSW准确率63.73%
F1值0.6459
文献[12]流统计特征CIC IoT混合准确率86.30%
F1值0.8760
文献[20]流统计特征和协议字段UNSW准确率98.40%
IoTBERT数据分组十六进制编码Aalto准确率97.20%
UNSWF1值0.9150
准确率92.10%
本文方法分组级流量语义特征通用表示Aalto准确率99.99%
F1值0.9999
UNSW准确率99.42%
F1值0.9941
CIC IoT混合准确率98.83%
F1值0.9884
), ArticleFig(id=1254010476128564140, tenantId=1146029695717560320, journalId=1251234646239789153, articleId=1254010453374464633, language=CN, label=表10, caption=

IoT设备识别技术对比

, figureFileSmall=null, figureFileBig=null, tableContent=
识别方法特征类型数据集评估指标结果
IoTSentinel数据分组头部字段Aalto准确率81.50%
文献[24]流统计特征AaltoF1值0.9030
IoTDevID数据分组头部字段和有效载荷Aalto准确率83.30%
UNSW准确率94.30%
文献[16]数据分组链路层语义特征UNSW准确率63.73%
F1值0.6459
文献[12]流统计特征CIC IoT混合准确率86.30%
F1值0.8760
文献[20]流统计特征和协议字段UNSW准确率98.40%
IoTBERT数据分组十六进制编码Aalto准确率97.20%
UNSWF1值0.9150
准确率92.10%
本文方法分组级流量语义特征通用表示Aalto准确率99.99%
F1值0.9999
UNSW准确率99.42%
F1值0.9941
CIC IoT混合准确率98.83%
F1值0.9884
)], attaches=null, journal=Journal(id=1251231495319236709, delFlag=0, nameCn=信息对抗技术, nameEn=Information Countermeasure Technology, nameHistory1=null, nameHistory2=null, issn=2097-163X, eissn=, cn=34-1340/E, coden=null, periodic=1, language=CN, oaType=1, ccby=null, superviseOffice=null, ownerOffice=null, pubOffice=null, editorOffice=null, officeType=null, aims=null, clcCode=null, officeProv=null, officeCity=null, officeAddr=null, officeZip=null, officeEmail=, officePhone=, editDirector=null, officeDirector=null, officeDirectorPhone=null, officeStaffNum=null, officeEmpNum=null, coverPicUrl=28NAsfRnEEIAv0GvsYImxg==, journalPrice=null, startedYear=null, abbrevIsoEn=Information Countermeasure Technology, journalRemark=null, publicationField=null, createdTime=1776246435243, updatedTime=1776397616785, createdBy=18614031015, updatedBy=13701087609, firstLetterCn=I, firstLetterEn=I, subjectCode=Engineering, subjectName=工程, subjectCodeEn=Engineering, subjectNameEn=null, picCn=28NAsfRnEEIAv0GvsYImxg==, picEn=W2zeGuQU+j8zRKRf0eBlGA==, jcr=null, cjcr=null, exts=[JournalExt(id=1251865596783182768, language=CN, name=信息对抗技术, nameHistory1=null, nameHistory2=null, managedBy=, sponsoredBy=, publishedBy=, editorOffice=, officeProv=null, officeCity=null, officeAddr=, officeZip=, editDirector=, officeDirector=null, officePhone=null, coverPicUrl=null, journalRemark=, submitArticleUrl=null, websiteUrl=, createdTime=1776397616811, updatedTime=1776397616811, createdBy=13701087609, updatedBy=13701087609, submissionGuidelinesUrl=, submissionAuthorUrl=http://xxdkjs.ijournals.cn/xxdk/author/login, submissionEditorUrl=http://xxdkjs.ijournals.cn/xxdk/editor/login, submissionReviewUrl=http://xxdkjs.ijournals.cn/xxdk/reviewer/login, submissionCeEditorUrl=, submissionAeEditorUrl=, option={"copyright":""}), JournalExt(id=1251865596854485937, language=EN, name=Information Countermeasure Technology, nameHistory1=null, nameHistory2=null, managedBy=, sponsoredBy=, publishedBy=, editorOffice=, officeProv=null, officeCity=null, officeAddr=, officeZip=, editDirector=, officeDirector=null, officePhone=null, coverPicUrl=null, journalRemark=, submitArticleUrl=null, websiteUrl=, createdTime=1776397616828, updatedTime=1776397616828, createdBy=13701087609, updatedBy=13701087609, submissionGuidelinesUrl=, submissionAuthorUrl=http://xxdkjs.ijournals.cn/xxdk/author/login, submissionEditorUrl=http://xxdkjs.ijournals.cn/xxdk/editor/login, submissionReviewUrl=http://xxdkjs.ijournals.cn/xxdk/reviewer/login, submissionCeEditorUrl=, submissionAeEditorUrl=, option={"copyright":""})], databaseList=null, tenantJournalId=1251234646239789153, websiteList=[Website(id=1251257283527786546, webName=null, webTitle=null, webDomain=null, webCopyrigh=null, webIpcNo=null, seoTitle=null, seoKeywords=null, seoDescription=null, tenantJournalId=null, journalId=1251234646239789153, journalNameCn=null, journalNameEn=null, grayFlag=null, tenantId=1146029695717560320, platformId=null, journalGroupId=null, journalGroupNameCn=null, journalGroupNameEn=null, type=1, domain=https://castjournals.cast.org.cn/joweb/xxdkjs/CN, language=CN, createTime=1776252583629, createBy=18614031015, updateTime=1776253877246, updateBy=18614031015, name=信息对抗技术-中文, tplId=1146099689490845704, title=信息对抗技术, delFlag=0, indexPage=/home, props=[WebsiteProps(id=1251262819858068136, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=articleTextType, value=kx, createTime=1776253903593, updateTime=1776253903593, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819841290917, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=banner, value=null, createTime=1776253903589, updateTime=1776253903589, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819879039659, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=grayFlag, value=0, createTime=1776253903598, updateTime=1776253903598, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819837096612, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=logo, value=https://castjournals.cast.org.cn/joweb/xxdkjs/CN/file/pic?fileId=ejr3qWSnlyLKPBFIFKSmqw==, createTime=1776253903588, updateTime=1776253903588, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819891622573, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=minRunFlag, value=0, createTime=1776253903601, updateTime=1776253903601, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819853873831, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=picServerUrl, value=https://castjournals.cast.org.cn/joweb/xxdkjs/CN/file/pic, createTime=1776253903592, updateTime=1776253903592, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819887428268, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=silenceFlag, value=0, createTime=1776253903600, updateTime=1776253903600, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819845485222, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=staticResourcePath, value=https://castjournals.cast.org.cn/joweb/cast_kjdb_cn_619/, createTime=1776253903590, updateTime=1776253903590, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819866456745, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=themeColor, value=null, createTime=1776253903595, updateTime=1776253903595, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262819870651050, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283527786546, code=themeStyle, value=null, createTime=1776253903596, updateTime=1776253903596, creator=18614031015, updator=18614031015)]), Website(id=1251257283611672652, webName=null, webTitle=null, webDomain=null, webCopyrigh=null, webIpcNo=null, seoTitle=null, seoKeywords=null, seoDescription=null, tenantJournalId=null, journalId=1251234646239789153, journalNameCn=null, journalNameEn=null, grayFlag=null, tenantId=1146029695717560320, platformId=null, journalGroupId=null, journalGroupNameCn=null, journalGroupNameEn=null, type=1, domain=https://castjournals.cast.org.cn/joweb/xxdkjs/EN, language=EN, createTime=1776252583649, createBy=18614031015, updateTime=1776253872573, updateBy=18614031015, name=信息对抗技术-英文, tplId=1146101810881728533, title=Information Countermeasure Technology, delFlag=0, indexPage=/home, props=[WebsiteProps(id=1251262790762185057, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=articleTextType, value=kx, createTime=1776253896656, updateTime=1776253896656, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790737019230, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=banner, value=null, createTime=1776253896650, updateTime=1776253896650, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790778962276, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=grayFlag, value=0, createTime=1776253896660, updateTime=1776253896660, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790728630621, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=logo, value=https://castjournals.cast.org.cn/joweb/xxdkjs/EN/file/pic?fileId=ejr3qWSnlyLKPBFIFKSmqw==, createTime=1776253896648, updateTime=1776253896648, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790791545190, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=minRunFlag, value=0, createTime=1776253896663, updateTime=1776253896663, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790753796448, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=picServerUrl, value=https://castjournals.cast.org.cn/joweb/xxdkjs/EN/file/pic, createTime=1776253896654, updateTime=1776253896654, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790783156581, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=silenceFlag, value=0, createTime=1776253896661, updateTime=1776253896661, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790745407839, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=staticResourcePath, value=https://castjournals.cast.org.cn/joweb/cast_kjdb_en_623/, createTime=1776253896652, updateTime=1776253896652, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790766379362, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=themeColor, value=null, createTime=1776253896657, updateTime=1776253896657, creator=18614031015, updator=18614031015), WebsiteProps(id=1251262790770573667, tenantId=1146029695717560320, journalId=null, journalGroupId=null, siteId=1251257283611672652, code=themeStyle, value=null, createTime=1776253896658, updateTime=1776253896658, creator=18614031015, updator=18614031015)])], journalTitle=信息对抗技术, weixinUrl=null, journalUrl=http://xxdkjs.ijournals.cn/, iacademicId=null, status=1, seqNo=null, journalTitleEn=Information Countermeasure Technology, journalPhotoCn=28NAsfRnEEIAv0GvsYImxg==, journalPhotoEn=W2zeGuQU+j8zRKRf0eBlGA==, journalFirstLetter=I, journalRecommend=null, journalNew=null, journalCollection=null, jcrJf=null, cjcrJf=null, jcrJfStr=null, cjcrJfStr=null, submissionFirstDecision=null, sciSubjectClassification=null, casSubjectClassification=null, citeScore=null, totalCitationFrequency=null, icpCode=null, psCode=null, advertisingLicenseCode=null, copyrightInformation=null, country=null, option=, provinceCode=null, provinceName=null, collectFlag=false), detailUrlCn=https://castjournals.cast.org.cn/joweb/xxdkjs/CN/10.12399/j.issn.2097-163x.2025.05.002, detailUrlEn=https://castjournals.cast.org.cn/joweb/xxdkjs/EN/10.12399/j.issn.2097-163x.2025.05.002, pdfUrlCn=https://castjournals.cast.org.cn/joweb/xxdkjs/CN/PDF/10.12399/j.issn.2097-163x.2025.05.002, pdfUrlEn=https://castjournals.cast.org.cn/joweb/xxdkjs/EN/PDF/10.12399/j.issn.2097-163x.2025.05.002, aliStartDate=null, aliEndDate=null, collectionFlag=false, citedCount=null, citedUrl=null, reference=null)
收藏切换
基于分组级流量语义特征增强的LLM IoT设备识别方法
收藏切换
PDF下载
尹鑫宇 , 施凡 , 许成喜 , 章建成 , 葛明仪
信息对抗技术 | 研究论文 2025,4(5): 22-41
收起
收藏切换
信息对抗技术 | 研究论文 2025, 4(5): 22-41
基于分组级流量语义特征增强的LLM IoT设备识别方法
全屏
尹鑫宇 , 施凡 , 许成喜 , 章建成 , 葛明仪
作者信息
  • 国防科技大学电子对抗学院，安徽　合肥　230037

    • 尹鑫宇　男，2002年生，硕士研究生，研究方向为网络空间测绘 E-mail:

    施凡　男，1983年生，博士，教授，研究方向为网络空间测绘和网络空间测量 E-mail:

    许成喜　男，1989年生，博士，副教授，研究方向为互联网基础设施安全和网络空间测绘 E-mail:

    章建成　男，2004年生，硕士研究生，研究方向为网络空间测绘 E-mail:

    葛明仪女，2003年生，硕士研究生，研究方向为网络空间测绘 E-mail:

通讯作者:

通信作者：施凡，E-mail:
IoT device identification method enhanced by packet-level traffic semantic features for large language models
Xinyu YIN , Fan SHI , Chengxi XU , Jiancheng ZHANG , Mingyi GE
Affiliations
  • College of Electronic Engineering, National University of Defense Technology, Hefei 230037,China
doi: 10.12399/j.issn.2097-163x.2025.05.002
文章导航
收藏切换
摘要
收起

随着物联网（IoT）技术在各领域的快速普及，网络设备识别已经成为网络安全防护体系的关键环节，实时发现接入网络的IoT设备对于网络管理、安全防护和性能优化至关重要。准确掌握网络动态并识别这些IoT设备，是有效防御黑客攻击的必要前提。传统机器学习的识别方法不仅效率低下、特征选取复杂、环境迁移能力差，其准确率也难以满足实际防护需求。为此，提出了一种基于分组级流量语义特征增强的大语言模型（LLM）IoT设备识别方法。首先，将复杂异构的IoT流量转化为通用的分组级流量语义特征；然后，使用分组级流量语义特征微调LLM，使LLM能够自动学习潜在IoT设备流量特征并执行设备分类识别决策，从而实现端到端高效的IoT设备识别。在公开数据集Aalto、UNSW和混合CIC IoT数据集（2022、2023）上的实验结果表明，所提方法能够基于分组级流量语义特征有效识别IoT设备，并且该方法的平均识别准确率分别达到99.99%、99.42%、98.83%。

物联网  /  设备识别  /  大语言模型  /  分组级流量语义特征

With the rapid popularization of Internet of Things（IoT）technology in various fields，network device identification has become a key link in the network security protection system. Real-time detection of IoT devices accessing the network is crucial for network management，security protection，and performance optimization. Accurately understanding network dynamics and identifying these IoT devices is a necessary prerequisite for effectively defending against hacker attacks. Traditional machine learning-based identification methods not only suffer from low efficiency，complex feature selection，and poor environmental transferability，but their accuracy also fails to meet the needs of practical protection. To address this issue，an IoT device identification method based on packet-level traffic semantic feature-enhanced large language models（LLM）was proposed. First，complex and heterogeneous IoT traffic was converted into universal packet-level traffic semantic features. Then，these packet-level traffic semantic features were used to fine-tune the LLM，enabling the LLM to automatically learn the potential traffic features of IoT devices and make device classification and identification decisions，thereby realizing end-to-end and efficient IoT device identification. Experimental results on the public datasets Aalto，UNSW，and hybrid CIC IoT datasets（2022，2023）show that the proposed method can effectively identify IoT devices based on packet-level traffic semantic features，and its the average identification accuracy can reach 99.99%，99.42%，and 98.83% respectively.

IoT  /  device identification  /  LLM  /  packet-level traffic semantic features
尹鑫宇, 施凡, 许成喜, 章建成, 葛明仪. 基于分组级流量语义特征增强的LLM IoT设备识别方法. 信息对抗技术, 2025 , 4 (5) : 22 -41 . DOI: 10.12399/j.issn.2097-163x.2025.05.002
Xinyu YIN, Fan SHI, Chengxi XU, Jiancheng ZHANG, Mingyi GE. IoT device identification method enhanced by packet-level traffic semantic features for large language models[J]. Information Countermeasure Technology, 2025 , 4 (5) : 22 -41 . DOI: 10.12399/j.issn.2097-163x.2025.05.002
正文
收起
0　引言
收起
物联网（Internet of Things，IoT）技术的快速发展和广泛应用正在深刻改变人类的生产生活方式。当前，各类智能终端设备已全面应用在消费电子、家居安防、工业控制等关键领域，形成规模庞大的设备生态。据市场研究机构预测，到2026年全球IoT设备接入规模将突破800亿台，相关市场规模预计攀升至1.1万亿美元[1-2]。这一迅猛增长态势在加速产业数字化转型的同时，也带来了显著的安全隐患。IoT基础设施一般由计算资源和能源受限的物联设备组成，基于IoT的应用普遍采用轻量级通信协议。IoT设备数量的激增直接导致了网络攻击面的急剧扩大。研究显示[3]，IoT设备普遍存在的安全防护不足、网络服务漏洞以及更新机制缺陷等问题，使得IoT系统面临日益严峻的安全威胁。其中，超过33%的IoT设备存在未修复的已知漏洞，攻击者通过利用存在漏洞的IoT设备对有价值的节点进行入侵攻击。Mirai僵尸网络攻击事件是IoT安全领域的典型威胁案例[4]。该恶意软件通过利用IoT设备的默认凭证漏洞，构建了大规模的僵尸网络，并针对关键网络基础设施发起分布式拒绝服务攻击，攻击导致包括Twitter、Netflix等在内的多个主流网站服务中断，造成了严重的经济损失。
从网络管理者角度出发，IoT安全防护的首要环节在于设备识别。运营商需要掌握完善的设备信息，以便快速筛选并隔离存在安全隐患的IoT终端设备，同时对存在漏洞的设备实施安全加固。准确识别设备类型不仅为网络安全策略的实施提供依据，更为后续的设备配置与功能管理奠定了重要基础。由此可见，高精度的IoT设备类型识别技术具有重要的研究价值和应用意义。
当前主流的IoT设备识别方法主要是通过提取网络流量特征而后基于机器学习模型的分类识别来进行设备分类。这类方法虽然能够帮助网络管理员监控设备运行状态，但是仍然存在局限性：一是现有方法提取流量特征（数据分组级、数据流级）对特定环境过拟合，导致所提取的特征没有较强的环境迁移能力[5]。二是现有基于数据流特征方法虽然有较强的泛化能力但需要积累大量的数据分组以达到必要的流量规模阈值，这种分析模式存在较高的延迟[6]。三是现有的方法无法很好适配复杂多变的IoT环境，当网络中出现新的IoT设备时，无法快速适应环境变化，大幅增加了模型部署难度。
为了解决上述问题，本文提出了一种基于分组级流量语义特征增强的大语言模型（large language model，LLM）IoT设备识别方法，该方法采用LLM作为基础架构，通过低秩自适应（low-rank adaptation，LoRA）微调（fine-tuning）技术实现高效的设备分类。具体而言，系统首先将原始网络流量转化为分组级流量语义特征；然后利用LoRA方法[7]对LLM进行参数高效的微调训练，使其能够准确理解分组级语义流量特征；在推理阶段，新采集流量数据经过相同特征转换后，可直接输入微调后的模型完成设备类型分类。本文的主要贡献如下：
1）提出一种基于分组级流量语义特征增强的LLM IoT设备识别方法，将异构流量转化为通用语义特征，利用LLM自动学习关键特征，突破传统人工特征通用性差的局限，支持加密流量识别，实现特征提取与分类的自动化。
2）该方法具备小样本高效学习能力，仅需约4.4%的训练数据即可快速收敛，在测试集上的准确率达到了97.82%，显著降低计算资源消耗。
3）在Aalto、UNSW、混合CIC IoT等公开数据集上开展实验，结果表明模型具有优异的跨场景泛化能力，可适应多样化网络环境下的设备识别需求。
1　相关工作
收起
随着IoT设备在智能家居、工业控制和医疗监护等领域的广泛应用，其安全性问题变得愈发突出。由于许多IoT设备受限于硬件资源且固件更新滞后，这些设备中存在大量已知及未知的安全漏洞，容易成为攻击者入侵内部网络的入口。因此，高效识别局域网中的IoT设备类型已成为网络安全防护体系中的关键环节之一[8]。准确识别设备类型有助于网络管理员迅速隔离异常或易受攻击的设备，防止攻击者利用这些设备进行横向渗透和长期潜伏。
基于机器学习的IoT设备识别方法广泛采用网络流量统计特征（如包大小、时延、协议类型）结合分类器（如随机森林、SVM等）进行分类[9-11]。RAHMAN等[12]构建了包含105种设备、超2亿条流量的大规模真实数据集，实验表明随机森林仅用12个特征即可实现高效分类。
为应对上述挑战，研究者开始采用深度学习实现自动特征学习，如用卷积神经网络（convolutional neural network，CNN）[13]建模原始流量，或用循环神经网络（recurrent neural network，RNN）捕捉时序依赖以提升精度[14]。然而，这类方法仍依赖大量标注数据，且模型结构固定，难以适应动态变化的设备行为。近年来，预训练语言模型（如BERT、ALBERT）被广泛应用于各类任务。文献[15]首次提出基于预训练Transformer的IoT设备识别方法IoTBERT，通过在无标签流量上预训练ALBERT学习特征表示，再结合标注数据微调并引入残差网络实现端到端识别。相比传统方法，IoTBERT无需人工特征工程，但跨场景泛化能力仍有局限。
此外，文献[16]表明，LLM使用链路级特征对IoT设备分类具备可行性。在Wi-Fi、Zigbee和蓝牙等多类设备上，该方法展现出良好的适应性：小样本下通过提示调优即可有效识别，大规模数据下微调后性能更具竞争力，验证了大模型在IoT设备识别方面的应用潜力。
2　研究方法
收起
2.1　IoT设备识别方法框架
本文提出的基于分组级流量语义特征增强的LLM IoT设备识别方法的使用场景如图1所示。该技术方案可使网络管理员实时掌握接入设备的类型及状态信息，有效识别未授权设备接入或异常行为，进而及时采取安全防护措施，保障智能环境系统的整体安全性。
该IoT设备识别方法采用多阶段处理流程（如图2所示）：首先对原始IoT流量进行解析，提取分组级语义信息（包括协议头部字段和载荷特征）;然后通过专用分词器将这些语义信息编码为数值化的词向量表示，形成LLM可理解的分组级流量语义向量特征；在模型训练阶段，基于LoRA方法对这些语义特征进行高效微调，优化LLM的参数；最终在推理阶段，将待识别设备的流量语义特征输入微调后的LLM，通过模型自动学习的关键特征完成设备类型的分类识别。该流程在保证处理效率的同时，显著提升了模型对异构IoT设备的识别准确率。本文还拓展了模型的持续学习能力，通过引入增量学习策略，在仅需少量内存和训练时间的条件下，能够有效保留模型在原有任务中学习到的先验知识，同时显著提升对新加入设备的识别准确率，从而缓解模型在持续学习过程中面临的遗忘问题。
2.2　面向LLM输入的分组级流量语义信息提取方法
本文提出了一种面向LLM输入的分组级流量语义信息提取方法，其核心目标是从原始网络流量中抽取出具有通用语义价值的分组级特征，并与IoT分析指令进行有机融合，最终转化为适合LLM处理的标准化输入格式，见算法1所示。
具体实现流程分为4个关键步骤：第1步进行协议层过滤，首先基于传输层协议对数据进行筛选，仅保留包含TCP或UDP层的有效数据包，以排除不相关或低语义价值的数据干扰。第2步为有效载荷筛选，旨在进一步剔除不包含应用层有效载荷的数据包，如TCP/UDP空数据包（如纯ACK包等）。该步骤有助于聚焦承载实际通信内容的数据流，从而提升所提取语义信息的相关性与实用性。第3步通过预定义的分组级流量语义特征字段集合（如图3所示），将原始二进制流量数据转换为结构化的文本表示形式。在此过程中，移除了引入噪声的MAC地址和IP地址相关信息，并将应用层有效载荷转换为十六进制编码，以保留其原始语义信息的同时增强通用性。该特征提取方式对明文与加密流量均具适用性，尤其适用于无法解析高层协议语义信息的加密通信场景。
第4步，格式标准化，如图4所示，生成符合LLM输入要求的标准化格式。在模型训练、推理过程中，本文采用基于专家知识的instruction构建训练、训练数据模板，将LLM有效适配到流量语义空间。设计的instruction模板能够智能引导模型自动提取流量数据中的关键模式特征。具体实现上，本文采用Tshark工具[17]结合自定义Python脚本提取各协议层的结构化字段信息，通过数据清洗过滤干扰性MAC地址和IP地址字段，并将其规范化为“字段名：值”的键值对形式。同时，定义特殊标识符<packet>作为流量数据起始标记，最终构建包含分析指令与结构化流量数据的训练样本。该格式既保留了原始流量的关键语义特征，又实现了与自然语言指令之间的无缝衔接。该通用表示方法被进一步应用于IoT设备识别等下游任务以及模型微调过程中，展现出良好的适应性和泛化能力。
相较于传统方法，本方法采用端到端的学习策略，直接从原始流量中提取训练数据以学习通用流量语义表征，从而获得优异的跨场景泛化性能。
2.3　分组级流量语义信息分词器优化
本文提出了一种分组级流量语义信息分词器优化方法，该方法的核心创新点在于构建了专用的流量分词器，有效扩展了LLM原生分词器的语义处理能力，使LLM能够准确理解异构流量数据并构建有效的语义表征。
基于大规模训练数据的统计分析，我们提取了所有协议字段名（分组级流量语义特征字段，如图3所示）和高频特殊字符（如\u00b7、<packet>、0x等）作为特殊tokens扩展LLM的分词器。由于LLM原生分词器缺乏对异构IoT网络流量数据的先验知识，该扩展显著提升了模型对流量语义的理解能力。实验采用ChatGLM4[18]作为基础模型，见表1所列。
改进后的分词器在流量数据处理上展现出显著优势：添加特殊token的分词器将流量数据的平均拆分长度从763.25降低至687.38，完整保留了字段名称和特殊字符的结构信息，而默认分词器则会导致这些关键语义单元被不合理拆分。定量分析表明，改进后的分词器能够更精确地建模流量语义信息，不仅提升了模型的理解能力，还显著减少了训练时长。特别地，在小样本学习场景下，该表征方法使大模型展现出更优异的特征提取和理解能力。
2.4　基于参数高效微调的可拓展性适配
为实现LLM基于分组级流量语义特征的IoT设备分类，并增强其在动态IoT环境中的快速适应能力，本文提出了一种新的模型优化方法。该方法的核心在于充分利用LLM固有的模式挖掘和泛化能力，通过Transformer架构强大的记忆特性，从通用流量语义信息（如数据包长度、传输方向、协议标志位等）中自动学习具有高度区分性的关键流量特征。
本文以ChatGLM4-9B作为基础模型架构，采用基于LoRA的微调策略，使LLM能够有效获取IoT领域的专业知识。这种方法特别适用于复杂异构的流量环境下的IoT设备精准识别任务。在技术实现上，我们针对传统训练方法存在的局限性进行了重要改进。
假设预训练LLM的参数为θLLM，传统全参数训练方法需要更新全部模型参数（即|Δθ|=|θLLM|）。这种方案存在2个显著缺陷：一是LLM庞大的参数量会导致新环境适应过程中的计算成本过高；二是全参数更新可能引发灾难性遗忘，导致模型丧失基础语言理解能力。
为解决这些问题，本文采用LoRA微调技术，实现参数高效微调（parameter-efficient fine-tuning）具体包括：一是冻结LLM的主干参数θLLM，保持其基础语言理解能力不变；二是引入低秩适配旁路结构，通过矩阵分解技术实现参数高效更新；三是专门构建面向IoT流量特征学习的适配参数模块θnow。这种微调策略不仅大幅降低了计算资源需求，更重要的是保留了模型原有的语言理解能力，同时实现了对IoT流量特征的精准捕捉。实验证明，该方法在保持模型基础性能的前提下，显著提升了IoT设备分类的准确率和环境适应效率。
给定安全专家的自然语言指令Iinstruction以及流量数据x∈X={x0，x1，…，xn}（包含n个流量标记），流量检测任务要求将Iinstruction和x作为LLM输入。随后，LLM利用合成的IoT流量特征学习的参数θ识别得到设备分类结果y∈{y1，y2，…，ym}（包含m个不同类型的IoT设备）。其中：
式中，θLLM为预训练大语言模型的原始参数，在微调过程中保持冻结，以保留其通用语义理解能力；θnow为通过低秩自适应引入的可训练参数，用于高效适配网络流量语义特征，避免全参数微调带来的计算开销。
LLM微调采用如下损失函数。其中，X为分组级流量语义序列，即X={x1，x2，…，xn}，每个xi表示输入序列中第i个token。模型通过自回归方式学习序列的上下文依赖关系。具体表达式如下：
式中，Wl是用于流量包级语义信息表示学习的可训练参数矩阵；hi-1表示LLM在输入前i-1个token后所编码的隐藏状态，反映了当前流量序列的历史上下文信息。通过逐个token预测的方式，使LLM能够有效捕捉流量数据中的时序特征与语义结构，从而实现对网络流量的通用语义表示学习。
针对IoT环境中设备频繁接入和通信协议多样化的情况，使用了一种基于LoRA轻量级适配IoT流量动态变化方案，使LLM能够快速适应不断变化的网络环境，更新适配参数模块为θnew。如图5所示，当面对新型设备或协议时，本文的方法仅需微调模型0.029 6%的参数，即可实现高效的领域适应。实验表明，该方案显著降低了模型适配成本，具体表现为：GPU显存消耗减少80%，训练时间缩短50%。相比传统的全参数微调方法，本方案有效解决了IoT场景中模型重新训练带来的高计算成本问题，为实际部署中的动态流量识别任务提供了可行的轻量化解决方案。
为实现模型在动态网络环境下的持续适应能力，本文引入一个可迭代的参数更新函数Update（·），用于在线优化轻量级适配模块。该机制旨在根据新观测到的流量模式和安全指令反馈，动态调整模型对物联网设备特征的表征能力。具体表达式如下：
式中，θnew表示更新后的适配参数模块；表示融合了最新适配能力的合成参数，用于学习和识别更新后的物联网流量特征；表示更新后模型识别出的设备类型集合，包含k个类别，即∈{y1，y2，…，yk}。
3　论证实验
收起
3.1　实验数据源
本文选用了公开的Aalto数据集[19]，涵盖了31种常见的智能设备类别，包括智能照明、摄像头、家用电器以及健康监测设备等。其中大多数测试设备通过Wi-Fi或以太网接入用户的网络；部分设备则通过ZigBee或Z-Wave等IoT协议，借助以太网或Wi-Fi集线器设备间接连接网络。Aalto数据集中包含了一定比例的加密通信流量，尤其是在涉及用户隐私和敏感数据传输的应用场景下，如智能家居控制指令和健康监测数据。
此外，本文采用公开的UNSW数据集[20]，该数据集涵盖设备自主通信及用户交互产生的动态流量，包含丰富的IoT协议与应用层内容，具有良好的真实性和代表性。数据集共包含21种IoT设备（如智能摄像头、传感器、健康监测仪等）和9种非IoT设备（如平板电脑、笔记本电脑和智能手机）。本文统一把非IoT设备归类为“non-IoT”这一单一类别，以构建更具区分度的分类任务。值得注意的是，该数据集中存在大量基于TLS/SSL等协议的加密流量，能够有效支持模型在加密环境下的设备识别能力评估。
本文还采用了加拿大网络安全研究所（CIC）发布的CIC IoT 2022[21]和CIC IoT 2023数据集[22]。数据涵盖了59种常见IoT设备（如智能音箱、智能插座等）在空闲与活动状态下的网络流量行为。本文将上述数据集中空闲与活动状态的正常流量进行整合，构建了一个大规模的良性流量数据集，用于模型的验证与泛化能力评估。值得注意的是，该数据集包含大量加密通信流量，尤其在涉及隐私敏感的设备（如智能音箱、摄像头）中，广泛采用TLS/DTLS协议进行传输层安全保护，进一步增强了模型在真实加密环境下的适用性验证。
3.2　数据预处理
本文实验中，微调所使用的数据是通过使用Tshark工具结合自定义的Python脚本，按照MAC地址对原始流量进行划分后获取的。为进一步避免数据分组中协议数据单元（PDU）头部字段（如IP地址或MAC地址）对模型训练造成干扰，在预处理阶段删除了IP地址和以太网地址字段。
随后，利用Tshark工具提取各协议层的结构化字段信息，并通过编写Python脚本对数据进行清洗，过滤掉无关或干扰性的MAC地址与IP地址，最终将有效字段规范化为“字段名：值”的键值对形式。对于载荷部分，将原始的二进制数据转换为十六进制表示，并在每2个十六进制数据之间插入冒号“：”作为分隔符[23]。最后在数据集中抽取数据样本，数据集数量分布如图6～8所示。在微调阶段，将数据集按照6:2:2的比例划分为训练集、验证集和测试集，以用于模型的参数调整和方法评估。
3.3　实验环境及评估指标
3.3.1　实验环境及参数设置
本文实验在Python 3.10.16和PyTorch 2.6.0（GPU版本）的深度学习框架下进行，硬件平台采用Intel（R）Xeon（R）Gold 6 330 CPU @2.00 GHz处理器和NVIDIA A800 80 GB PCIe Tensor Core GPU加速器，操作系统为Ubuntu 22.04 LTS。本实验是基于GLM4-9B预训练模型架构进行LoRA微调，在模型微调参数的选择上，设置训练轮数为3，初始学习率为5×10-5，优化器选用Adam，采用BF16混合精度训练策略，启用16线程并行数据预加载，配置单卡批处理大小为4，设置秩（rank）r=8、缩放因子α=32，对Transformer架构中的查询、键、值投影层进行适配，并引入0.1的LoRA dropout率以增强模型泛化能力；考虑到IoT设备流量的语义特征与序列长度分布，输入序列最大长度设为2 048个token，输出序列最大长度限定为32个token。训练完成后生成的模型具备良好的部署灵活性，可在配备RTX 4 090或RTX 3 090等用户级GPU的设备上高效运行，适用于边缘侧或本地化大模型应用场景。
3.3.2　评估指标
本文采用多维度评估指标体系对模型性能进行全面衡量，具体包括准确率（accuracy）、精确率（precision）、召回率（recall）和F1值（F1-score）4个核心指标。为消除类别不平衡带来的评估偏差，采用各类别指标的平均值作为最终评价标准。各指标定义如下：
1）准确率。反映模型整体预测准确度，表示为：
式中，TTP表示预测正确的阳性样本数，TTN表示预测正确的阴性样本数，FFP表示预测错误的阳性样本数，FFN表示预测错误的阴性样本数。
2）精确率。衡量模型预测正例的可靠性，表示为：
3）召回率。评估模型识别正例的全面性，表示为：
4）F1值。综合精确率和召回率的调和平均值，表示为：
3.4　实验结果及分析
3.4.1　超参数设置对模型效率与特征表达的影响
输入序列长度和秩是影响LLM性能的关键超参数。GLM4-9B模型支持的最大输入序列长度为128 000。当输入序列超过该长度时，需进行截断处理；若短于该长度，则使用<|endoftext|>标记进行填充以达到统一长度。序列长度的设置对模型性能具有显著影响：过长的序列会引入大量<|endoftext|>标记，增加不必要的计算开销并可能干扰模型注意力机制；过短的序列则可能导致IoT流量数据中的关键上下文信息丢失，影响特征表达的完整性。
对于秩而言，在LoRA等参数高效微调方法中，秩的大小直接关系到模型的拟合能力：秩过大时，模型参数增多，容易导致过拟合，尤其在训练数据有限的情况下泛化性能下降；秩过小时，模型的表达能力受限，难以捕捉复杂的特征模式，导致学习不足。因此，合理选择序列长度与秩的取值对于平衡模型效率与性能至关重要，需结合具体任务和数据特性进行优化，如图9所示。
3.4.2　在Aalto、UNSW与CIC IoT数据集上的识别性能验证
测试数据基于以上指标进行评估。Aalto测试集上的平均准确率、召回率以及F1值指标分别达到99.99%、99.99%、0.999 9;UNSW测试集上的平均准确率、召回率以及F1值指标分别达到99.42%、99.41%、0.994 1;CIC IoT混合测试数据集上的平均准确率、召回率以及F1值指标分别达到98.83%、98.83%、0.988 4。表2～4列出了模型在公共数据集上对每个IoT设备的识别结果。
从实验结果可以看出，本文微调的LLM对大多数设备的识别精确率都很高，能达到95%以上。在Aalto数据集上的测试结果表明，该模型展现出卓越的IoT设备分类能力。测试结果显示，31种设备中有28种实现了100%的完美识别率，其精确率、召回率达到100%，F1值达到1.000 0。其余设备的识别性能同样出色。
在UNSW数据集上的测试结果表明，该模型展现出优异的设备分类能力，能够准确区分IoT设备与非IoT设备。模型对非IoT设备的识别精确率高达99.35%，剩下IoT设备的精确率均为95%以上，其中6种设备实现了精确率、召回率为100%，F1值为1.000 0的完美识别率。总体而言，该模型在UNSW数据集上表现出了强大的分类性能和高准确性。
在CIC IoT混合数据集上的实验结果表明，该模型在复杂网络环境（包括设备的空闲状态与交互状态）以及跨时间段场景下展现出良好的鲁棒性与适应性。模型在所有IoT设备类别上的平均准确率超过98%，其中13种设备实现了精确率、召回率为100%，F1值为1.000 0的完美识别率，验证了其在多样化流量条件下的稳定分类性能。此外，实验结果进一步表明，该模型不仅能够准确区分不同类型的IoT设备，还具备对同类型设备不同硬件版本（如Amazon Echo Dot 1与Echo Dot 2、Teckin Plug1与Plug2等）进行细粒度识别的能力。这一特性表明模型能够捕捉设备间细微的通信行为差异，具备较强的特征表达能力。综上所述，该模型在真实复杂网络环境中展现出高效且精确的设备识别能力，具有较强的实用价值与部署潜力。
图10～12展示了分类模型在测试集上的预测混淆矩阵分析结果（按行归一化，反映召回率）。实验结果表明，尽管原始数据集中存在一定程度的噪声干扰和冗余流量，导致极少数样本被误分类，但这些误差对模型整体的识别准确率影响较小。总体来看，模型仍展现出优异的分类性能，具有较高的识别精度和良好的泛化能力。
3.4.3　小样本场景下的识别性能验证
在流量过小的场景下无法提取相应的统计特征，或提取到的特征不足以完成识别任务，本文随机选取了UNSW数据集中的8 000条流量对模型进行微调。其平均准确率、召回率以及F1值指标分别达到了97.82%、97.82%、0.978 0。小样本数据集（UNSW）中每个IoT设备的识别结果见表5所列，分类模型在测试集上的预测混淆矩阵（按行归一化，反映召回率）分析结果如图13所示。
在UNSW实验场景中，本文引入了一类实际部署中常见的IoT设备D-Link Door Sensor，并采集其网络流量数据，基于原有数据集训练的模型，采用参数高效微调（PEFT）技术对新增设备进行快速适配，具体配置包括：使用GLM4-9B架构，在BF16混合精度下以学习率3×10-5、batch size为1、cosine学习率调度和10步warmup进行1轮训练，输入序列最大长度为2 048个token，输出序列最大长度为32个token，并通过LoRA（r=8，α=32，ddropout=0.1）对查询-键-值投影层进行轻量化微调，从而实现对新环境的高效可扩展适应。
模型在包含新增设备的整体测试集上取得了99.10%的总体识别准确率。环境变化数据的精确率、召回率及F1值分类实验结果见表6所列。对于原有环境中的各类设备，识别精确率均保持在94%以上，展现出良好的泛化能力与稳定性。针对新增的D-Link Door Sensor设备，模型实现了对其100%的识别精确率，召回率达到98.18%，F1值为0.990 8。结果表明，该模型不仅能够高效识别原有设备，还能迅速适应新型设备的特征，在实际应用场景中，具备出色的可扩展性与实用性。
3.4.4　跨数据集下的识别泛化能力评估
跨数据集场景下的IoT设备识别泛化性能实验，为评估模型的跨数据集泛化能力，本文在CIC IoT混合数据集上将Amazon Echo系列的多个子型号（如Echo Dot、Echo Show、Echo Studio等）聚合为统一类别“Amazon Echo”。同时，选取在2个数据集中表示相同或高度相似IoT设备类型的设备，包括Borun Sichuan AI Camera、Fibaro Home Center Lite、LIFX Light Bulb、Philips Hue Bridge和TP-Link Tapo Camera，用于测试在UNSW数据集上训练的模型对这些设备的识别性能。
实验结果（见表7所列）表明，模型在CIC-IoT数据集中的“Amazon Echo”类别上取得了优异表现，精确率、召回率和F1值分别达到100%、99.89%、0.999 4。此外，对其他设备的识别效果同样出色，Borun Sichuan AI Camera的精确率、召回率和F1值分别为99.93%、100%、0.999 7;Fibaro Home Center Lite的分别为100%、99.87%、0.999 3;LIFX Light Bulb的分别达到100%、100%、1.000 0;Philips Hue Bridge的分别达到99.80%、99.87%、0.998 3;TP-Link Tapo Camera的分别达到100%、81.87%、0.900 3。上述结果充分验证了该模型在不同数据分布下的强鲁棒性及在实际场景中的应用潜力。
3.4.5　加密环境下的识别性能验证
在加密环境下对IoT设备识别模型的性能评估实验中，提取了UNSW数据集中的所有加密流量数据，用于测试模型在加密场景下的识别能力。实验结果（见表8所列）表明，模型取得了99.94%的准确率、99.94%的召回率以及0.999 1的F1值。这表明，即使在完全加密的网络环境中，模型仍能保持极高的识别性能。
3.4.6　面向设备伪装攻击的识别性能验证
在真实网络环境中，攻击者可能通过伪造IP地址、MAC地址甚至OUI（组织唯一标识符）来伪装设备身份。为评估模型在此类对抗场景下的鲁棒性，在UNSW数据集上对OUI字段进行随机化处理，模拟设备硬件标识的恶意伪造行为，并在此基础上进行训练与测试。实验结果（见表9所列）表明，模型在该伪装场景下仍取得了98.46%的准确率、98.46%的召回率和0.984 5的F1值，展现出对伪造标识信息的良好抵抗能力与较强的现实适应性。
3.5　对比实验
对比实验的主要内容包括：原始大模型与微调模型的性能对比、原始与改进分词器的性能对比、不同载荷长度截取的对比。
3.5.1　原始大模型与微调模型的性能对比实验
为评估LLM在IoT设备识别中的领域适应能力，本文对比了原始模型与微调模型的性能。实验在UNSW测试集上进行，采用准确率、召回率和F1值作为评价指标。结果（如图14所示）表明，原始模型的准确率与召回率均为16.93%，F1值为0.148 9，识别效果较差。经IoT流量数据微调后，模型性能显著提升，其准确率、召回率分别达到99.42%、99.41%，F1值为0.994 1。微调有效增强了模型对领域特征的学习能力，大幅提升了分类精度。
3.5.2　原始与改进分词器性能对比实验
原始分词器在处理流量数据时，往往会对语义信息进行碎片化切分，导致关键信息被分割，不利于模型理解。而改进后的专用分词器能够更好地保留并完整切分出流量中的关键语义信息，有助于大模型更准确地理解和学习数据特征。
如图15所示，该图从平均令牌长度、模型训练时长以及小样本训练准确率3个方面对默认分词器与专用分词器进行了对比。可以看出，在平均令牌长度方面，专用分词器显著减少了分割后的token数量，由默认分词器的763.2个降低至687.4个，说明其在语义压缩和表达效率方面更具优势；在模型训练时长方面，使用专用分词器后训练时间由31.1 h缩短至27.3 h，训练效率明显提升；而在小样本训练准确率上，专用分词器达到了97.8%，相较默认分词器的94.4%提升了约3.4%，展现出更强的小样本学习能力和泛化性能。
3.5.3　不同载荷长度截取的对比实验
本文分别在小样本环境与充足样本环境下（Aalto数据集）评估了不同数据载荷长度对模型准确率的影响。实验结果显示，随着数据载荷长度的增加，模型的识别准确率呈现出显著上升趋势。尤其值得注意的是，在截取的数据载荷长度达到1 024字节时，模型达到了最优的准确度表现，如图16所示。
3.5.4　对比讨论
表10对比了现有IoT设备识别方法的关键技术指标，包括数据处理方式、特征提取策略和识别性能等。通过统一采用Aalto、UNSW、CIC IoT混合数据集进行评测，可以客观比较不同方法的分类效果。
在IoT设备识别领域，多种方法已被提出并应用于实际场景中，然而这些方法在特征提取、算法选择以及识别性能上仍存在不同程度的局限性。IoTSentinel模型[19]主要依赖于协议字段信息、IP地址和数据包大小等数据包属性进行特征提取，其平均识别准确率约为81.50% ;文献[24]通过对数据分组的各个字段进行特征筛选，最终实现了约0.903 0的F1值。IoTDevID方法[25]针对Aalto和UNSW数据集中的数据包内容行为特征进行建模，在这2个数据集上的识别准确率分别为83.30%和94.30%。该方法依赖于繁琐的特征筛选过程，且所提取的特征通用性较差。基于LLM的设备分类方法利用链路层协议特征并通过微调实现设备识别[16]，最终在UNSW数据集上达到63.73%的准确率，但由于特征表达能力不足，整体性能仍有提升空间。文献[12]通过使用传统的机器学习方法，如决策树、随机森林、K近邻和支持向量机，基于流统计特征来进行训练，识别准确率达到86.30%，但其依赖长时间流量统计，导致识别延迟较高。文献[20]方法结合网络流量分析，提取协议字段的端口号、DNS地址及密码信息，并与流统计特征相结合，最终识别准确率约为98.40%。IoTBERT方法[15]通过使用数据分组编码作为输入，在设备识别准确率上有所提升，在Aalto数据集中的准确率为97.20%，在UNSW数据集中为92.10%，但在不同环境下的稳定性仍显不足。
相比之下，本文提出的IoT设备识别方法在多个方面展现出显著优势。在识别精度方面，本方法在Aalto数据集上取得了99.99%的准确率，在UNSW数据集上达到99.42%，在CIC IoT混合数据集上亦达到98.83%，均优于现有主流方法，体现出卓越的分类性能。
4　结束语
收起
本文提出了一种基于分组级流量语义特征增强的LLM IoT设备识别方法。该方法通过将复杂异构的IoT流量转化为标准化的分组级流量语义特征，利用LLM强大的特征学习能力，实现了端到端的高效设备识别。具体而言，本方法具有以下突出优势：一是通过分组级流量语义特征的通用表示，有效解决了传统方法中关键特征筛选复杂的问题；二是借助LLM的强大表征学习能力，可以自动捕获IoT设备流量的深层次特征；三是端到端的识别框架大大简化了识别流程，提高了识别效率。在公开数据集Aalto、UNSW、CIC IoT混合数据集上的实验结果表明，本文方法的平均识别准确率均显著优于其他的现有方法。
然而，在实际网络环境中仍存在一些需要进一步解决的问题：一是网络流量中可能存在复杂的异常数据包（攻击或恶意流量），这些异常数据可能会影响模型的初始特征学习；二是虽然通用分组级语义特征表示避免了复杂的关键特征筛选工程，但在面对大规模、高频率的冗余流量（如周期性心跳包、重复广播帧等）时，影响模型的推理效率与资源利用率。为此，建议在实际部署时增加数据预处理模块，并配备高性能计算设备以确保模型的最佳性能。
在未来的研究工作中，我们将持续扩充IoT设备流量语义特征的规模与多样性，以构建更具通用性和表征能力的设备流量特征表示。为进一步提升模型性能，下一步将持续扩展数据集覆盖范围，纳入更多基于不同通信协议和应用场景的IoT设备类型，同时增加非IoT设备样本，从而全面提升模型的分类准确率和跨场景泛化能力。特别地，未来将重点探索零样本与小样本学习技术在IoT设备识别领域的创新应用，开发自适应学习框架以应对新型设备快速接入带来的识别挑战，显著提升模型对未知设备的泛化性能。
文献
收起
参考文献 引证文献
排序方式：
[1]
ROSEN M. Driving the digital agenda requires strategic architecture[EB/OL].(2015-04-22)[2025-07-01]. https://idc-cema.com/dwn/SF_177701.
[2]
FORTUNE BUSINESS INSIGHTS.IoT market size, growth:IoT industry report 2026[EB/OL].(2019-01-01)[2025-07-01].https://www.fortunebusinessinsights.com/industry-reports/internet-of-things-iot-market-100307.
[3]
ALLIFANN M, ZUALKERNAN I A. Ranking security of IoT-based smart home consumer devices[J]. IEEE Access,2022, 10: 18352-18369.
[4]
ZHANG X L, UPTON O, BEEBE N L, et al. IoT botnet forensics: a comprehensive digital forensic case study on mirai botnet servers[J]. Forensic Science International: Digital Investigation,2020,32:300926.
[5]
SHENG C, ZHOU W, HAN Q-L,et al. Network traffic fingerprinting for IIoT device identification: a survey[J].IEEE Transactions on Industrial Informatics, 2025, 21(5): 3541-3554.
[6]
WU H,WU Q Y,GUANG C,et al.SFIM:identify user behavior based on stable features[J]. Peer-to-Peer Networking and Applications,2021,14(6):3674-3687.
[7]
HU E, SHEN Y L, WALLIS P,et al. LoRA: low-rank adaptation of large Language models[EB/OL].[2025-07-01].https://arxiv.org/pdf/2106.09685v1/1000.
[8]
樊琳娜,李城龙,吴毅超,等.物联网设备识别及异常检测研究综述[J].软件学报,2024,35(1): 288-308.
FAN Linna, LI Chenglong, WU Yichao, et al. Survey on IoT device identification and anomaly detection[J]. Journal of Software,2024,35(1): 288-308.(in Chinese)
[9]
STEINWART I,CHRISTMANN A. Support vector machines[M]. New York:Springer, 2008.
[10]
CHEN T Q, GUESTRIN C. XGBoost: a scalable tree boosting system[C]//Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. San Francisco:ACM, 2016:785-794.
[11]
TAUNK K, DE S, VERMA S, et al. A brief review of nearest neighbor algorithm for learning and classification[C]//Proceedings of 2019 International Conference on Intelligent Computing and Control Systems.Madurai:IEEE, 2019:1255-1259.
[12]
RAHMAN M M,BOUHAFS F, HOSEINI S A,et al. UNSW HomeNet: a network traffic flow dataset for AI-based smart home device classification[J]. Computers& Industrial Engineering,2025,204:111041.
[13]
KUMAR R,SWARNKAR M, SINGAL G,et al. IoT network traffic classification using machine learning algorithms: an experimental analysis[J]. IEEE Internet of Things Journal,2022,9(2): 989-1008.
[14]
TAKASAKI C, KORIKAWA T,HATTORI K,et al. Traffic behavior-based device type classification[C]//Proceedings of 2023 International Conference on Computing,Networking and Communications.Honolulu:IEEE,2023: 353-357.
[15]
邢长友,王梓澎,张国敏,等.基于预训练Transformers的物联网设备识别方法[J].信息网络安全,2024, 24(8):1277-1290.
XING Changyou,WANG Zipeng,ZHANG Guomin, et al. IoT device identification method based on pre-trained Transformers[J]. Netinfo Security, 2024, 24(8): 1277-1290.(in Chinese)
[16]
MORALES G, ROMIT F T,BIENEK-PARRISH A, et al. IoT device classification using link-level features for traditional machine learning and large language models[C]//Proceedings of the 10th International Conference on Information Systems Security and Privacy.[S.l.: s.n.],2024:297-308.
[17]
COMBS G. Wireshark and Tshark network protocol analyzer[EB/OL].[2025-07-01].https://www.wireshark.org.
[18]
ZENG A H, XU B, WANG B W, et al. ChatGLM: a family of large language models from GLM-130B to GLM-4 all tools[EB/OL].[2025-07-01].https://arxiv.org/abs/2406.12793.
[19]
MIETTINEN M, MARCHAL S, HAFEEZ N,et al. IoT sentinel demo:automated device-type identification for security enforcement in IoT[C]//Proceedings of the 37th International Conference on Distributed Computing Systems. Atlanta:IEEE,2017:2177-2184.
[20]
SIVANATHAN A, GHARAKHEILI H H, LOI F, et al. Classifying IoT devices in smart environments using network traffic characteristics[J].IEEE Transactions on Mobile Computing,2019,18(8): 1745-1759.
[21]
DADKHAH S,MAHDIKHANI H,DANSO P K,et al. Towards the development of a realistic multidimensional IoT profiling dataset[C]//Proceedings of the 19th Annual International Conference on Privacy, Security& Trust.Fredericton:IEEE,2022:1-11.
[22]
NETO E C P, DADKHAH S, FERREIRA R, et al. CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment[J]. Sensors, 2023,23(13):5941.
[23]
The Wireshark Project. Wireshark user's guide[EB/OL].[2025-07-01].https://www.wireshark.org/docs/.
[24]
HAMAD S A, ZHANG W E, SHENG Q Z, et al. IoT device identification via network-flow based fingerprinting and learning[C]//Proceedings of the 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications. Rotorua: IEEE, 2019: 103-111.
[25]
KOSTAS K, JUST M, LONES M A, et al. IoTDevID:a behavior-based device identification method for the IoT[J].IEEE Internet of Things Journal,2022, 9(23):23741-23749.
2025年第4卷第5期
PDF下载
86
38
引用本文
BibTeX
文章信息
doi: 10.12399/j.issn.2097-163x.2025.05.002
  • 接收时间：2025-07-03
  • 首发时间：2026-04-23
补充材料
相关文章
文章信息
作者
出版历史
  • 收稿日期：2025-07-03
  • 修回日期：2025-09-09
基金
作者信息
    国防科技大学电子对抗学院，安徽　合肥　230037

通讯作者:

通信作者：施凡，E-mail:
参考文献
分享链接
https://castjournals.cast.org.cn/joweb/xxdkjs/CN/10.12399/j.issn.2097-163x.2025.05.002
分享至
全文二维码

扫描看全文

引用本文
BibTeX
本文的引用情况
2种不同金属材料的力学参数
科
Family		 属数
Number of
genus		 种数
Number of
species		 占总种数比例
Percentage of
total species (%)		 属
Genus		 种数
Number of
species		 占总种数比例
Percentage of total
species (%)
鹅膏菌科Amanitaceae 2 11 5.26 鹅膏菌属 Amanita 10 4.78
小菇科 Mycenaceae 2 12 5.74 丝盖伞属 Inocybe 5 2.39
多孔菌科 Polyporaceae 8 14 6.70 蜡蘑属 Laccaria 5 2.39
红菇科 Russulaceae 3 23 11.00 小皮伞属 Marasmius 6 2.87
小菇属 Mycena 11 5.26
光柄菇属 Pluteus 5 2.39
红菇属 Russula 17 8.13
栓菌属 Trametes 5 2.39
关闭全屏
相关链接
论文
最新文章
热读文章
热点专题
内参
蓝皮书
产业发展报告
传播力报告
期刊分级目录
资讯
学术新闻
行业新闻
学术会议
行业会议
关于
关于我们
联系我们
北京市海淀区学院南路86号
100081
010-62199257
qkjq@cast.org.cn

中国科学技术协会版权所有 京ICP 备10216604号-4 海淀分局备案 1101084647
科技导报社主办 中国科协信息中心技术支持