Accurate identification of Internet of Things (IoT) devices, such as cameras, lightbulbs, and voice assistants, is important for security management and policy enforcement. Existing approaches identify devices from packet- or flow-level traffic characteristics. Manufacturer Usage Description (MUD) profiles provide a complementary, policy-level representation of intended device communication via Access Control Entries (ACEs), which encode protocol, endpoint, direction, and port semantics. While exact ACE matching is effective when observed behavior overlaps with the reference profile, it provides little evidence when that overlap becomes sparse. This paper investigates the semantic matching of individual ACEs as behavioral primitives for MUD-based IoT device identification. Our specific contributions are threefold. (1) Using 28 publicly available MUD profiles containing 1,023 ACE instances, we show that representing individual ACEs preserves behavioral distinctions that are obscured when an entire profile is represented by a single vector. (2) Through controlled experiments with unseen ACEs, endpoint perturbation, and partial observation, we characterize how semantic matching behaves as exact overlap decreases. (3) Using real IoT traffic traces comprising more than 800,000 flows, we show that semantic matching provides stronger evidence during early and sparse-overlap observations, whereas exact matching becomes stronger as stable overlap accumulates. These results demonstrate that semantic ACE matching can complement exact MUD matching when runtime observations provide limited literal overlap with reference profiles. We release the code and research artifacts to support reproducibility.

翻译：暂无翻译