{"id":"https://openalex.org/W3015181824","doi":"https://doi.org/10.1109/jiot.2020.2984030","title":"Detecting Behavioral Change of IoT Devices Using Clustering-Based Network Traffic Modeling","display_name":"Detecting Behavioral Change of IoT Devices Using Clustering-Based Network Traffic Modeling","publication_year":2020,"publication_date":"2020-03-30","ids":{"openalex":"https://openalex.org/W3015181824","doi":"https://doi.org/10.1109/jiot.2020.2984030","mag":"3015181824"},"language":"en","primary_location":{"id":"doi:10.1109/jiot.2020.2984030","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2020.2984030","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5070030239","display_name":"Arunan Sivanathan","orcid":"https://orcid.org/0000-0002-5596-8372"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Arunan Sivanathan","raw_affiliation_strings":["School of Electrical Engineering and Telecommunications, University of New South Wales, Sydney, Australia","School of Electrical Engineering & Telecommunications University of New South Wales Sydney NSW Australia"],"raw_orcid":"https://orcid.org/0000-0002-5596-8372","affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Telecommunications, University of New South Wales, Sydney, Australia","institution_ids":["https://openalex.org/I31746571"]},{"raw_affiliation_string":"School of Electrical Engineering & Telecommunications University of New South Wales Sydney NSW Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030677680","display_name":"Hassan Habibi Gharakheili","orcid":"https://orcid.org/0000-0002-9333-7635"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Hassan Habibi Gharakheili","raw_affiliation_strings":["School of Electrical Engineering and Telecommunications, University of New South Wales, Sydney, Australia","School of Electrical Engineering & Telecommunications University of New South Wales Sydney NSW Australia"],"raw_orcid":"https://orcid.org/0000-0002-9333-7635","affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Telecommunications, University of New South Wales, Sydney, Australia","institution_ids":["https://openalex.org/I31746571"]},{"raw_affiliation_string":"School of Electrical Engineering & Telecommunications University of New South Wales Sydney NSW Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5091021682","display_name":"Vijay Sivaraman","orcid":"https://orcid.org/0000-0001-7985-6765"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Vijay Sivaraman","raw_affiliation_strings":["School of Electrical Engineering and Telecommunications, University of New South Wales, Sydney, Australia","School of Electrical Engineering & Telecommunications University of New South Wales Sydney NSW Australia"],"raw_orcid":"https://orcid.org/0000-0001-7985-6765","affiliations":[{"raw_affiliation_string":"School of Electrical Engineering and Telecommunications, University of New South Wales, Sydney, Australia","institution_ids":["https://openalex.org/I31746571"]},{"raw_affiliation_string":"School of Electrical Engineering & Telecommunications University of New South Wales Sydney NSW Australia","institution_ids":["https://openalex.org/I31746571"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I31746571"],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":5.5307,"has_fulltext":false,"cited_by_count":69,"citation_normalized_percentile":{"value":0.95825705,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":"7","issue":"8","first_page":"7295","last_page":"7309"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8344844579696655},{"id":"https://openalex.org/keywords/firmware","display_name":"Firmware","score":0.659102201461792},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5603303909301758},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.48451846837997437},{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.45355847477912903},{"id":"https://openalex.org/keywords/networking-hardware","display_name":"Networking hardware","score":0.41754189133644104},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.41662928462028503},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.4083468019962311},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.34266775846481323},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.34084975719451904},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.32916659116744995},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2557981610298157}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8344844579696655},{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.659102201461792},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5603303909301758},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.48451846837997437},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.45355847477912903},{"id":"https://openalex.org/C159631557","wikidata":"https://www.wikidata.org/wiki/Q1546066","display_name":"Networking hardware","level":2,"score":0.41754189133644104},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.41662928462028503},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.4083468019962311},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.34266775846481323},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.34084975719451904},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.32916659116744995},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2557981610298157},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2020.2984030","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2020.2984030","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6399999856948853,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":62,"referenced_works":["https://openalex.org/W36488923","https://openalex.org/W1484038941","https://openalex.org/W1516506771","https://openalex.org/W1550206324","https://openalex.org/W1606099259","https://openalex.org/W1674877186","https://openalex.org/W1775772884","https://openalex.org/W1980849679","https://openalex.org/W1985987493","https://openalex.org/W2001037010","https://openalex.org/W2004042461","https://openalex.org/W2014563571","https://openalex.org/W2075694051","https://openalex.org/W2099242680","https://openalex.org/W2120617515","https://openalex.org/W2130523241","https://openalex.org/W2142889610","https://openalex.org/W2157665255","https://openalex.org/W2157949690","https://openalex.org/W2183512662","https://openalex.org/W2184638288","https://openalex.org/W2342408547","https://openalex.org/W2377065004","https://openalex.org/W2485229854","https://openalex.org/W2487887313","https://openalex.org/W2574448563","https://openalex.org/W2621148797","https://openalex.org/W2626904088","https://openalex.org/W2740234477","https://openalex.org/W2754804809","https://openalex.org/W2757758197","https://openalex.org/W2768718335","https://openalex.org/W2781517838","https://openalex.org/W2797742547","https://openalex.org/W2799758613","https://openalex.org/W2801559222","https://openalex.org/W2886897065","https://openalex.org/W2887149310","https://openalex.org/W2888505697","https://openalex.org/W2908736334","https://openalex.org/W2928689123","https://openalex.org/W2952773240","https://openalex.org/W2962117360","https://openalex.org/W2963471098","https://openalex.org/W2963899832","https://openalex.org/W2965788285","https://openalex.org/W2966399854","https://openalex.org/W2978799815","https://openalex.org/W2989766846","https://openalex.org/W3005645561","https://openalex.org/W3014695699","https://openalex.org/W3105750153","https://openalex.org/W3122864121","https://openalex.org/W4245409806","https://openalex.org/W4285719527","https://openalex.org/W6629187924","https://openalex.org/W6632865047","https://openalex.org/W6638021444","https://openalex.org/W6683235873","https://openalex.org/W6686520046","https://openalex.org/W6709343346","https://openalex.org/W6739405186"],"related_works":["https://openalex.org/W2582981600","https://openalex.org/W4387467152","https://openalex.org/W4253989935","https://openalex.org/W2066354466","https://openalex.org/W4379115910","https://openalex.org/W3010413952","https://openalex.org/W2070793896","https://openalex.org/W4287635472","https://openalex.org/W4206124993","https://openalex.org/W2084585803"],"abstract_inverted_index":{"The":[0],"Internet":[1],"of":[2,38,49,56,83,122,174,180,205,266,295],"Things":[3],"(IoT)":[4],"is":[5],"increasingly":[6],"becoming":[7],"a":[8,120,148],"major":[9],"challenge":[10],"for":[11,46,129,217,253],"network":[12,78,91,130,163,199,224,241],"administrators":[13],"to":[14,24,62,71,107,119,132,156,201,220,235,272,287],"manage":[15],"connected":[16],"devices":[17,33,84,108,160,238,282],"and":[18,27,40,53,79,165,232,257,260,276,283],"sensors":[19],"ranging":[20],"from":[21,104,197,239,278],"smart":[22],"lights":[23],"smoke":[25],"alarms":[26],"security":[28],"cameras,":[29],"at":[30],"scale.":[31],"IoT":[32,58,97,159,207,237,281],"use":[34,233],"an":[35,212,292],"extensive":[36],"variety":[37],"firmware":[39,102],"provide":[41],"little":[42],"(or":[43],"no)":[44],"access":[45],"the":[47,57,77,81,94,113,140,203,264],"management":[48],"their":[50,74,90,162,222,240],"operating":[51],"systems":[52],"configurations.":[54],"Operators":[55],"infrastructure,":[59],"therefore,":[60],"need":[61],"employ":[63],"traffic":[64,191,242,273],"classification":[65,134,151,249],"models":[66,135,231],"(trained":[67],"by":[68,88,161,250,269],"historical":[69],"data)":[70],"automatically":[72,100,157],"detect":[73,158,221,288],"assets":[75,171],"on":[76],"ensure":[80],"health":[82],"against":[85],"cyber":[86],"attacks":[87],"monitoring":[89],"behavior.":[92],"On":[93],"other":[95],"hand,":[96],"manufacturers":[98],"often":[99],"perform":[101],"upgrades":[103],"cloud":[105],"servers":[106],"that":[109,153,193],"are":[110,185],"operational":[111],"in":[112,170,243],"field.":[114],"This":[115],"can":[116,194],"potentially":[117],"lead":[118],"change":[121],"device":[123,150,176,208,219],"behavior":[124,204],"which":[125],"makes":[126],"it":[127,271],"difficult":[128],"operators":[131,155],"maintain":[133],"(incorporating":[136],"changes":[137,169,290],"without":[138],"retraining":[139],"entire":[141],"model).":[142],"In":[143],"this":[144],"article,":[145],"we":[146,188,227,262],"develop":[147,211],"modular":[149],"architecture":[152],"allows":[154],"activity":[164],"dynamically":[166],"accommodate":[167],"legitimate":[168],"(either":[172],"addition":[173],"new":[175],"profile":[177],"or":[178],"upgrade":[179],"existing":[181],"profiles).":[182],"Our":[183],"contributions":[184],"threefold:":[186],"1)":[187],"identify":[189],"key":[190],"attributes":[192],"be":[195],"obtained":[196],"flow-level":[198],"telemetry":[200],"characterize":[202],"various":[206],"types.":[209],"We":[210,246],"unsupervised":[213],"one-class":[214],"clustering":[215,230],"method":[216],"each":[218],"normal":[223],"behavior;":[225],"2)":[226],"tune":[228],"device-specific":[229],"them":[234],"classify":[236],"real":[244,280],"time.":[245],"enhance":[247],"our":[248,267],"developing":[251],"methods":[252],"automatic":[254],"conflict":[255],"resolution":[256],"noise":[258],"filtering;":[259],"3)":[261],"evaluate":[263],"efficacy":[265],"scheme":[268],"applying":[270],"traces":[274],"(benign":[275],"attack)":[277],"ten":[279],"demonstrate":[284],"its":[285],"ability":[286],"behavioral":[289],"with":[291],"overall":[293],"accuracy":[294],"more":[296],"than":[297],"94%.":[298]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":17},{"year":2022,"cited_by_count":11},{"year":2021,"cited_by_count":11},{"year":2020,"cited_by_count":1}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}