Beyond Make-and-Model: Simplifying IoT Network Management with Behavioral Metaclasses

Systematically managing the cyber health of Internet of Things (IoT) networks at scale requires understanding the functions and behaviors of connected devices. Current IoT device management approaches rely on classifying these behaviors based on the make-and-model of devices. However, these make-and-model classes proliferate over time and do not generalize well to unseen devices or networks. To overcome this, we propose a method to classify IoT behaviors into higher-abstraction metaclasses. Our contributions are three-fold: (1) We develop a method based on Large Language Models (LLM) to derive metaclasses, grouping 125 IoT make-and-model types into 7 functionality-based classes, using public datasets collected from five IoT networks. (2) We train PacketTransformer – a GPT-2 classifier – on data from one network and evaluate its generalizability on four unseen networks. In our cross-network setting, classification using metaclasses achieves up to 38% higher accuracy than make-and-model classification. (3) We investigate performance-improvement strategies beyond the multiclass baseline by training separate models for each metaclass and by calibrating stacked one-class outputs. These experiments improve performance in several settings, with the strongest one-class results achieving balanced accuracies of 71% for Cameras, 75% for Speakers and 79% for Sensors.