{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,5]],"date-time":"2026-08-05T03:27:03Z","timestamp":1785900423135,"version":"3.56.0"},"reference-count":160,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","award":["H2020-830929 CyberSec4Europe"],"award-info":[{"award-number":["H2020-830929 CyberSec4Europe"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","award":["H2020-780139 SerIoT"],"award-info":[{"award-number":["H2020-780139 SerIoT"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","award":["H2020-952702 BIECO"],"award-info":[{"award-number":["H2020-952702 BIECO"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/access.2021.3111477","type":"journal-article","created":{"date-parts":[[2021,9,9]],"date-time":"2021-09-09T20:01:58Z","timestamp":1631217718000},"page":"126265-126285","source":"Crossref","is-referenced-by-count":18,"title":["Defining the Behavior of IoT Devices Through the MUD Standard: Review, Challenges, and Research Directions"],"prefix":"10.1109","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7697-116X","authenticated-orcid":false,"given":"Jose L.","family":"Hernandez-Ramos","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7997-5737","authenticated-orcid":false,"given":"Sara N.","family":"Matheu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9727-0861","authenticated-orcid":false,"given":"Angelo","family":"Feraudo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4830-1227","authenticated-orcid":false,"given":"Gianmarco","family":"Baldini","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7538-4788","authenticated-orcid":false,"given":"Jorge Bernal","family":"Bernabe","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Poonam","family":"Yadav","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5525-1259","authenticated-orcid":false,"given":"Antonio","family":"Skarmeta","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0992-7948","authenticated-orcid":false,"given":"Paolo","family":"Bellavista","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/IoTDI49375.2020.00027"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2019.2917972"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3022272"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/FIT47737.2019.00035"},{"key":"ref31","author":"chang","year":"2021","journal-title":"A Proactive Approach to Detect IoT Based Flooding Attacks by Using Software Defined Networks and Manufacturer Usage Descriptions"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/AINA.2018.00131"},{"key":"ref37","article-title":"Verifying and monitoring IoTs network behavior using MUD profiles","author":"hamza","year":"2019","journal-title":"arXiv 1902 02484"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3229565.3229571"},{"key":"ref35","year":"2021","journal-title":"Mudgee"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3229565.3229566"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2131"},{"key":"ref27","author":"garcia-morchon","year":"2019","journal-title":"State of the Art and Challenges for the Internet of Things"},{"key":"ref29","year":"2021","journal-title":"Link Layer Discovery Protocol"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2947157"},{"key":"ref22","year":"2018","journal-title":"802 1ar—Secure Device Identity"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.3390\/sym12091576"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8259"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.17487\/RFC7950"},{"key":"ref101","year":"2018","journal-title":"Dnsmasq"},{"key":"ref26","year":"2021","journal-title":"MUD Maker"},{"key":"ref100","year":"2021","journal-title":"Open Project"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8519"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1002\/widm.1219"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2017.1600613"},{"key":"ref154","author":"richardson","year":"2021","journal-title":"Authorized Update to MUD URLs"},{"key":"ref153","author":"moran","year":"2021","journal-title":"Strong Assertions of IoT Network Access Requirements"},{"key":"ref156","year":"2020","journal-title":"Iotivity"},{"key":"ref155","author":"richardson","year":"2020","journal-title":"On Loading MUD URLs From QR Codes"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1109\/5GWF49715.2020.9221407"},{"key":"ref152","author":"lear","year":"2020","journal-title":"Discovering and Accessing Software Bills of Materials"},{"key":"ref151","author":"lear","year":"2020","journal-title":"Bandwidth Profiling Extensions for MUD"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2970118"},{"key":"ref147","year":"2020","journal-title":"ENISA Threat Landscape for 5G Networks Report"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2017.1600907"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243846"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3579"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2904"},{"key":"ref57","first-page":"49","article-title":"Soft MUD: Implementing manufacturer usage descriptions on OpenFlow SDN switches","author":"ranganathan","year":"2019","journal-title":"Proc Int Conf Netw (ICN)"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2870658"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2019.2904475"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1023\/A:1018628609742"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-015-0328-7"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/IPTCOMM.2018.8567639"},{"key":"ref40","author":"fontein","year":"2021","journal-title":"For Whom the IoT-Bell Tolls"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00043"},{"key":"ref4","article-title":"IDIoT: Securing the Internet of Things like it’s 1994","author":"barrera","year":"2017","journal-title":"arXiv 1712 03623"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2018.03.012"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2019.01.023"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.14722\/diss.2018.23007"},{"key":"ref159","article-title":"‘They’re all about pushing the products and shiny things rather than fundamental security’ mapping socio-technical challenges in securing the smart home","author":"chen","year":"2021","journal-title":"arXiv 2105 11751"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2855563"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-23357-0_4"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2020.3023507"},{"key":"ref157","year":"2021","journal-title":"OCF Security Specification—Version 2 2 2"},{"key":"ref158","year":"0","journal-title":"Canadian Multistakeholder Process Enhancing IoT Security Report Final Outcomes and Recommendations Report"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-19150-8"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.17487\/rfc6347"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2904123"},{"key":"ref48","author":"hanes","year":"2021","journal-title":"Human Usage Description for 5G Networks Endpoints"},{"key":"ref47","author":"lear","year":"2021","journal-title":"Determining Nominal Quality of Service Needs of a Device"},{"key":"ref42","author":"nakahara","year":"2021","journal-title":"Malware Detection for IoT Devices Using Automatically Generated White List and Isolation Forest"},{"key":"ref41","author":"schutijser","year":"2021","journal-title":"Towards Automated DDoS Abuse Protection Using MUD Device Profiles"},{"key":"ref44","article-title":"Building system with dynamic manufacaturer usage description (MUD) files based on building model queries","author":"jin","year":"2020"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1201\/b11321"},{"key":"ref127","author":"bormann","year":"2020","journal-title":"Concise Binary Object Representation (CBOR)"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2959428"},{"key":"ref125","author":"selander","year":"2021","journal-title":"Ephemeral Diffie–Hellman over COSE (EDHOC)"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8520"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2017.2746186"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2862350"},{"key":"ref129","author":"mckinney","year":"2019","journal-title":"Graph-Based Analysis for IoT Devices With Manufacturer Usage Descriptions—An ScM Research Project"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3360322.3361004"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2018.03.022"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.17487\/rfc7252"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3314148.3314352"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1007\/s41109-019-0195-3"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/3009828"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2487361"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/1355734.1355746"},{"key":"ref133","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017","journal-title":"arXiv 1706 06083"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-34957-8_9"},{"key":"ref131","first-page":"1","article-title":"IoT network attack detection and mitigation","author":"gelenbe","year":"2020","journal-title":"Proc 9th Medit Conf Embedded Comput (MECO)"},{"key":"ref78","first-page":"117","article-title":"The design and implementation of open vSwitch","author":"pfaff","year":"2015","journal-title":"12th USENIX Symp Netw Syst Design Implement (NSDI)"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330961"},{"key":"ref79","author":"caswell","year":"2004","journal-title":"Snort 2 1 Intrusion Detection"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/CSCN.2019.8931384"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1504\/IJWGS.2018.095647"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2021.3084341"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2020.3002423"},{"key":"ref60","author":"andalibi","year":"2021","journal-title":"Throwing MUD Into the FOG Defending IoT and Fog by Expanding MUD to Fog Network"},{"key":"ref139","year":"2019","journal-title":"Regulation (EU) 2019\/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on Information and Communications Technology Cybersecurity Certification (Cybersecurity Act)"},{"key":"ref62","article-title":"Zero-touch IoT device provisioning","author":"shah","year":"2019"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2017.2762345"},{"key":"ref63","article-title":"Bootstrapping remote secure key infrastructures (BRSKI)","author":"pritikin","year":"2020"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.17487\/rfc7170"},{"key":"ref140","year":"2015","journal-title":"CNSSI No 4009 Committee on National Security Systems (CNSS) Glossary"},{"key":"ref65","author":"lear","year":"2021","journal-title":"Automatic Access-Control Admission and Management of Controllers for Things Using Manufacturer Usage Description"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1145\/3410160"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101658"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1016\/j.csi.2018.08.003"},{"key":"ref67","author":"ohba","year":"2008","journal-title":"Protocol for Carrying Authentication for Network Access"},{"key":"ref143","first-page":"546","article-title":"Potential cyberattacks on automated vehicles","volume":"16","author":"petit","year":"2015","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5247"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2017.12.041"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2017.201"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4764"},{"key":"ref145","first-page":"21","article-title":"Hackers remotely kill a jeep on the highway—With me it","volume":"7","author":"greenberg","year":"2015","journal-title":"Wired"},{"key":"ref1","volume":"27","author":"ramos","year":"2020","journal-title":"Security Challenges and Solutions in the Internet of Things"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2006.322172"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.06.002"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1145\/2620728.2620744"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2020.2975749"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/WoWMoM.2014.6918985"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/3378679.3394528"},{"key":"ref106","article-title":"Securing small business and home Internet of Things (IoT) devices: Mitigating network-based attacks using manufacturer usage description (MUD)","author":"dodson","year":"2020"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-02300-7"},{"key":"ref105","author":"van der walt","year":"2011","journal-title":"FreeRADIUS Beginner's Guide"},{"key":"ref91","first-page":"85","article-title":"Smart lamp or security camera? Automatic identification of IoT devices","author":"thomsen","year":"2020","journal-title":"Proc IEEE Int Conf Netw"},{"key":"ref104","year":"2021","journal-title":"Mud-Manager"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2015.7045396"},{"key":"ref103","year":"2021","journal-title":"Micronets Manufacturer Usage Description (MUD) Tools"},{"key":"ref102","year":"2021","journal-title":"Openwrt table of hardware"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2014.6786613"},{"key":"ref112","year":"2021","journal-title":"MUDdy Tool"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2004.38"},{"key":"ref98","author":"gangurde","year":"2021","journal-title":"Automation of IoT Pre-Certification Security Testing Environment Based on the Manufacturing Usage Description"},{"key":"ref99","year":"2018","journal-title":"Open Source Manufacture Usage Specification"},{"key":"ref96","author":"lade","year":"2021","journal-title":"802 11AX for the Internet of Things—Machine Learning Assisted Optimized Power Save Techniques for IoT Devices Using 802 11AX Target Wake Time"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2871099"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8520"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICCE46568.2020.9043121"},{"key":"ref12","author":"polk","year":"2017","journal-title":"Mitigating IoT-Based Automated Distributed Threats"},{"key":"ref13","year":"2019","journal-title":"Securing Small-Business and Home Internet of Things Devices NIST SP 1800–15"},{"key":"ref14","year":"2019","journal-title":"Good Practices for Security of IoT—Secure Software Development Lifecycle"},{"key":"ref15","first-page":"717","article-title":"SDN based intrusion detection and prevention systems using manufacturer usage description: A survey","volume":"11","author":"mazhar","year":"2020","journal-title":"Int J Adv Comput Sci Appl"},{"key":"ref118","article-title":"Methodology for characterizing network behavior of Internet of Things devices (draft)","author":"watrobski","year":"2020"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2762291"},{"key":"ref82","author":"bormann","year":"2020","journal-title":"An Authorization Information Format (AIF) for ACE"},{"key":"ref117","year":"2021","journal-title":"MUD-PD"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3065123"},{"key":"ref81","author":"erdtman","year":"2018","journal-title":"CBOR Web Token (CWT)"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.3390\/app9214576"},{"key":"ref84","year":"2013","journal-title":"eXtensible Access Control Markup Language Version 3 0"},{"key":"ref119","year":"2021","journal-title":"NIST MUD"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.3390\/s20071882"},{"key":"ref83","author":"fink","year":"2020","journal-title":"Extending MUD to Smartphones"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-81111-2_11"},{"key":"ref113","year":"2021","journal-title":"Mud Visualizer"},{"key":"ref116","author":"sanders","year":"2017","journal-title":"Practical Packet Analysis Using Wireshark to Solve Real-World Network Problems"},{"key":"ref80","year":"2021","journal-title":"Anastacia H2020 project"},{"key":"ref115","year":"2021","journal-title":"MUD-URL-Validator"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/LCOMM.2017.2766636"},{"key":"ref89","article-title":"NFV-based IoT security for home networks using MUD","author":"afek","year":"2019","journal-title":"arXiv 1911 00253"},{"key":"ref121","author":"reddy","year":"2020","journal-title":"MUD (D)TLS Profiles for IoT Devices"},{"key":"ref122","article-title":"A novel conflict detection method for ABAC security policies","volume":"22","author":"liu","year":"2021","journal-title":"J Ind Inf Integr"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1145\/3388176.3388188"},{"key":"ref85","article-title":"SoK: Beyond IoT MUD deployments—challenges and future directions","author":"feraudo","year":"2020","journal-title":"arXiv 2004 08003"},{"key":"ref86","doi-asserted-by":"crossref","first-page":"203","DOI":"10.1080\/00224065.1986.11979014","article-title":"The exponentially weighted moving average","volume":"18","author":"stuart","year":"1986","journal-title":"J Quality Technol"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1002\/widm.53"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS47738.2020.9110409"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9312710\/09531614.pdf?arnumber=9531614","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,12,17]],"date-time":"2021-12-17T19:55:32Z","timestamp":1639770932000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9531614\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":160,"URL":"https:\/\/doi.org\/10.1109\/access.2021.3111477","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}