Unsupervised Baseline Clustering and Incremental Adaptation for IoT Device Traffic Profiling
The growth and heterogeneity of IoT devices create security challenges where static identification models can degrade as traffic evolves. This paper presents a two-stage, flow-feature-based pipeline for unsupervised IoT device traffic profiling and incremental model updating, evaluated on selected long-duration captures from the Deakin IoT dataset. For baseline profiling, density-based clustering (DBSCAN) isolates a substantial outlier portion of the data and produces the strongest alignment with ground-truth device labels among tested classical methods (NMI 0.78), outperforming centroid-based clustering on cluster purity. For incremental adaptation, we evaluate stream-oriented clustering approaches and find that BIRCH supports efficient updates (0.13 seconds per update) and forms comparatively coherent clusters for a held-out novel device (purity 0.87), but with limited capture of novel traffic (share 0.72) and a measurable trade-off in known-device accuracy after adaptation (0.71). Overall, the results highlight a practical trade-off between high-purity static profiling and the flexibility of incremental clustering for evolving IoT environments.
Code (0)
등록된 구현이 없습니다.
Similar Papers 제목 키워드 기반
Unsupervised Model Personalization while Preserving Privacy and Scalability: An Open Problem
This work investigates the task of unsupervised model personalization, adapted to continually evolving, unlabeled local user images. We consider the practical scenario where a high capacity server interacts with a myriad…
Continual LearningDomain AdaptationIncremental LearningScene RecognitionUnsupervised Social Event Detection via Hybrid Graph Contrastive Learning and Reinforced Incremental Clustering
Detecting events from social media data streams is gradually attracting researchers. The innate challenge for detecting events is to extract discriminative information from social media data thereby assigning the data in…
ClusteringContrastive LearningEvent DetectionIncremental Layer-wise Self-Supervised Learning for Efficient Speech Domain Adaptation On Device
Streaming end-to-end speech recognition models have been widely applied to mobile devices and show significant improvement in efficiency. These models are typically trained on the server using transcribed speech data. Ho…
Domain AdaptationSelf-Supervised Learningspeech-recognitionSpeech RecognitionAdversarial Unsupervised Domain Adaptation Guided with Deep Clustering for Face Presentation Attack Detection
Face Presentation Attack Detection (PAD) has drawn increasing attentions to secure the face recognition systems that are widely used in many applications. Conventional face anti-spoofing methods have been proposed, assum…
ClusteringDeep ClusteringDomain AdaptationFace Anti-Spoofing+3Federated Unsupervised Domain Adaptation for Face Recognition
Given labeled data in a source domain, unsupervised domain adaptation has been widely adopted to generalize models for unlabeled data in a target domain, whose data distributions are different. However, existing works ar…
ClusteringDomain AdaptationFace RecognitionFederated Learning+1