{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,21]],"date-time":"2026-05-21T17:27:20Z","timestamp":1779384440145,"version":"3.53.1"},"reference-count":44,"publisher":"Association for Computing Machinery (ACM)","issue":"3","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"published-print":{"date-parts":[[2026,8,31]]},"abstract":"<jats:p>As the Internet of Things (IoT) becomes more embedded within our daily lives, there is growing concern about the risk \u201csmart\u201d devices pose to network security. To address this, one avenue of research has focused on automated IoT device identification. This research is broadly motivated by the idea that the more we can know about our devices, the more secure the networks they are on can be. Research has however largely neglected the identification of IoT device firmware versions. There is strong evidence that IoT security relies on devices being on the latest version patched for known vulnerabilities. Identifying when a device has updated (has changed version) or not (is on a stable version) is therefore useful for IoT security. Version identification involves challenges beyond those for identifying the model, type, and manufacturer of IoT devices. Most obviously, the differences between versions are more subtle and therefore harder to detect. Moreover, because there has been relatively little research in this area, there are no widely available datasets that track devices\u2019 version changes over time. Consequently, traditional machine learning algorithms are ill-suited for effective version identification due to being limited by the availability of data for training. In this article, we introduce an effective technique for identifying IoT device versions based on transfer learning. This technique relies on the idea that we can use a Twin Neural Network (TNN)\u2014trained at distinguishing devices\u2014to detect differences between a device on different versions. This facilitates real-world implementation by requiring relatively little training data. In more detail, we extract statistical features from on-wire packet flows, convert these features into greyscale images, pass these images into a TNN to output similarity scores, and determine version changes based on the Hedges\u2019 g effect size of the similarity scores. This allows us to detect the subtle changes present in on-wire traffic when a device changes version. To evaluate our technique, we set up a lab containing 12 IoT devices and recorded their on-wire packet captures for 11 days across multiple firmware versions. For testing data held out from training, our best performing model is shown to be 95.83% and 84.38% accurate at identifying stable versions and version changes, respectively.<\/jats:p>","DOI":"10.1145\/3799713","type":"journal-article","created":{"date-parts":[[2026,3,7]],"date-time":"2026-03-07T20:40:19Z","timestamp":1772916019000},"page":"1-30","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["IoT Firmware Version Identification Using Transfer Learning with Twin Neural Networks"],"prefix":"10.1145","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8657-3448","authenticated-orcid":false,"given":"Ashley","family":"Andrews","sequence":"first","affiliation":[{"name":"Electrical, Electronic and Mechanical Engineering, University of Bristol","place":["Bristol, United Kingdom of Great Britain and Northern Ireland"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1684-6989","authenticated-orcid":false,"given":"George","family":"Oikonomou","sequence":"additional","affiliation":[{"name":"Electrical, Electronic and Mechanical Engineering, University of Bristol","place":["Bristol, United Kingdom of Great Britain and Northern Ireland"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-6319-9789","authenticated-orcid":false,"given":"Simon","family":"Armour","sequence":"additional","affiliation":[{"name":"Electrical, Electronic and Mechanical Engineering, University of Bristol","place":["Bristol, United Kingdom of Great Britain and Northern Ireland"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-5538-0338","authenticated-orcid":false,"given":"Paul","family":"Thomas","sequence":"additional","affiliation":[{"name":"University of Bristol","place":["Bristol, United Kingdom of Great Britain and Northern Ireland"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-2069-4922","authenticated-orcid":false,"given":"Thomas","family":"Cattermole","sequence":"additional","affiliation":[{"name":"Tiberos Research","place":["London, United Kingdom of Great Britain and Northern Ireland"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,4,22]]},"reference":[{"key":"e_1_3_2_2_2","series-title":"ARES \u201922","volume-title":"Proceedings of the 17th International Conference on Availability, Reliability and Security","author":"Agrafiotis Georgios","year":"2022","unstructured":"Georgios Agrafiotis, Eftychia Makri, Ioannis Flionis, Antonios Lalas, Konstantinos Votis, and Dimitrios Tzovaras. 2022. Image-based neural network models for malware traffic classification using PCAP to picture conversion. In Proceedings of the 17th International Conference on Availability, Reliability and Security (Vienna, Austria) (ARES \u201922). Association for Computing Machinery, New York, NY, USA, Article 59, 7 pages."},{"key":"e_1_3_2_3_2","unstructured":"Amazon Web Services. 2024. AWS IoT Device Defender FAQs. Retrieved from https:\/\/aws.amazon.com\/iot-device-defender\/faq\/. [Accessed: 07.04.2024]."},{"key":"e_1_3_2_4_2","first-page":"1","volume-title":"ICC 2020-2020 IEEE International Conference on Communications (ICC)","author":"Ammar Nesrine","year":"2020","unstructured":"Nesrine Ammar, Ludovic Noirie, and Sebastien Tixeuil. 2020. Autonomous identification of IoT device types based on a supervised classification. In ICC 2020-2020 IEEE International Conference on Communications (ICC). IEEE, 1\u20136."},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/FMEC57183.2022.10062747"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/3605758.3623492"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/WF-IoT58464.2023.10539470"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2025.3568673"},{"key":"e_1_3_2_9_2","article-title":"How Hackers Could Use Doll to Open Your Front Door","year":"2017","unstructured":"BBC. 2017. How Hackers Could Use Doll to Open Your Front Door. Retrieved from https:\/\/www.bbc.co.uk\/news\/av\/technology-38966285. [Accessed: 07.04.2024].","journal-title":"https:\/\/www.bbc.co.uk\/news\/av\/technology-38966285"},{"key":"e_1_3_2_10_2","article-title":"Smart Doorbells \u2019Easy Target for Hackers\u201d Study Finds","year":"2020","unstructured":"BBC. 2020. Smart Doorbells \u2019Easy Target for Hackers\u201d Study Finds. Retrieved from https:\/\/www.bbc.co.uk\/news\/technology-55044568. [Accessed: 07.04.2024].","journal-title":"https:\/\/www.bbc.co.uk\/news\/technology-55044568"},{"key":"e_1_3_2_11_2","unstructured":"BBC. 2023. The Tech Flaw that Lets Hackers Control Surveillance Cameras. Retrieved from https:\/\/www.bbc.co.uk\/news\/technology-65975446. [Accessed: 07.04.2024]."},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2020.04.085"},{"key":"e_1_3_2_13_2","article-title":"Signature verification using a \u201cSiamese\u201d time delay neural network","volume":"6","author":"Bromley Jane","year":"1993","unstructured":"Jane Bromley, Isabelle Guyon, Yann LeCun, Eduard S\u00e4ckinger, and Roopak Shah. 1993. Signature verification using a \u201cSiamese\u201d time delay neural network. Advances in Neural Information Processing Systems 6 (1993), 737\u2013744.","journal-title":"Advances in Neural Information Processing Systems"},{"issue":"2","key":"e_1_3_2_14_2","first-page":"1","article-title":"Secure firmware update: Challenges and solutions","volume":"7","author":"Catuogno Luigi","year":"2023","unstructured":"Luigi Catuogno and Clemente Galdi. 2023. Secure firmware update: Challenges and solutions. Cryptography 7, 2 (2023), 1\u201317.","journal-title":"Cryptography"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3035087"},{"key":"e_1_3_2_16_2","unstructured":"Cyfirma. 2022. Thousands of Hikvision Cameras are still vulnerable and can be potentially exploited. Retrieved from https:\/\/www.cyfirma.com\/research\/thousands-of-hikvision-cameras-are-still-vulnerable-and-can-be-potentially-exploited. [Accessed: 07.04.2024]."},{"key":"e_1_3_2_17_2","unstructured":"Sounak Dey Anjan Dutta J. Ignacio Toledo Suman K. Ghosh Josep Llados and Umapada Pal. 2017. SigNet: Convolutional Siamese Network for Writer Independent Offline Signature Verification. arXiv:1707.02131. Retrieved from https:\/\/arxiv.org\/abs1707.02131"},{"issue":"12","key":"e_1_3_2_18_2","article-title":"Image-based approach to intrusion detection in cyber-physical objects","volume":"13","author":"Golubev Sergey","year":"2022","unstructured":"Sergey Golubev, Evgenia Novikova, and Elena Fedorchenko. 2022. Image-based approach to intrusion detection in cyber-physical objects. Information 13, 12 (2022). Retrieved from https:\/\/www.mdpi.com\/2078-2489\/13\/12\/553","journal-title":"Information"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1145\/3437984.3458842"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3131014"},{"key":"e_1_3_2_21_2","first-page":"373","article-title":"A convolutional neural network based model with improved activation function and optimizer for effective intrusion detection and classification","volume":"7","author":"Kabir Solaiman","year":"2021","unstructured":"Solaiman Kabir, Sadman Sakib, Md Akib Hossain, Safi Islam, and Muhammad Iqbal Hossain. 2021. A convolutional neural network based model with improved activation function and optimizer for effective intrusion detection and classification. 2021 International Conference on Advance Computing and Innovative Technologies in Engineering, ICACITE 2021 7 (2021), 373\u2013378.","journal-title":"2021 International Conference on Advance Computing and Innovative Technologies in Engineering, ICACITE 2021"},{"key":"e_1_3_2_22_2","first-page":"8","volume-title":"Proceedings of the 32nd International Conference on Machine Learning 2015","volume":"37","author":"Koch Gregory","year":"2015","unstructured":"Gregory Koch, Richard Zemel, and Ruslan Salakhutdinov. 2015. Siamese neural networks for one-shot image recognition. In Proceedings of the 32nd International Conference on Machine Learning 2015, Vol. 37. JMLR.org, 8 pages."},{"key":"e_1_3_2_23_2","article-title":"IoT Device Identification using Deep Learning","author":"Kotak Jaidip","year":"2020","unstructured":"Jaidip Kotak and Yuval Elovici. 2020. IoT Device Identification using Deep Learning. arXiv.","journal-title":"arXiv"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2018.8486326"},{"issue":"12","key":"e_1_3_2_25_2","article-title":"Payload-based traffic classification using multi-layer LSTM in software defined networks","volume":"9","author":"Lim Hyun Kyo","year":"2019","unstructured":"Hyun Kyo Lim, Ju Bong Kim, Kwihoon Kim, Yong Geun Hong, and Youn Hee Han. 2019. Payload-based traffic classification using multi-layer LSTM in software defined networks. Applied Sciences (Switzerland) 9, 12 (2019), 1\u201316.","journal-title":"Applied Sciences (Switzerland)"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2019.2904364"},{"key":"e_1_3_2_27_2","article-title":"Detection of Unauthorized IoT Devices Using Machine Learning Techniques","author":"Meidan Yair","year":"2017","unstructured":"Yair Meidan, Michael Bohadana, Asaf Shabtai, Martin Ochoa, Nils Ole Tippenhauer, Juan Davis Guarnizo, and Yuval Elovici. 2017. Detection of Unauthorized IoT Devices Using Machine Learning Techniques. arXiv preprint arXiv:1709.04647.","journal-title":"arXiv preprint"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101968"},{"key":"e_1_3_2_29_2","unstructured":"Microsoft. 2024. Microsoft Defender for IoT. Retrieved from https:\/\/www.microsoft.com\/en-gb\/security\/business\/endpoint-security\/microsoft-defender-iot. [Accessed: 07.04.2024]."},{"key":"e_1_3_2_30_2","doi-asserted-by":"crossref","unstructured":"Nizar Msadek Ridha Soua and Thomas Engel. 2019. IoT device fingerprinting: Machine learning based encrypted traffic analysis. IEEE Wireless Communications and Networking Conference (WCNC). Marrakesh Morocco 1\u20138.","DOI":"10.1109\/WCNC.2019.8885429"},{"issue":"2","key":"e_1_3_2_31_2","article-title":"CNN for user activity detection using encrypted in-app mobile data","volume":"14","author":"Pathmaperuma Madushi H.","year":"2022","unstructured":"Madushi H. Pathmaperuma, Yogachandran Rahulamathavan, Safak Dogan, and Ahmet Kondoz. 2022. CNN for user activity detection using encrypted in-app mobile data. Future Internet 14, 2 (2022), 1\u201318.","journal-title":"Future Internet"},{"key":"e_1_3_2_32_2","first-page":"474","volume-title":"Proceedings - 5th IEEE European Symposium on Security and Privacy, Euro S and P 2020","author":"Perdisci Roberto","year":"2020","unstructured":"Roberto Perdisci, Thomas Papastergiou, Omar Alrawi, and Manos Antonakakis. 2020. IoTFinder: Efficient large-scale identification of IoT devices via passive DNS traffic analysis. In Proceedings - 5th IEEE European Symposium on Security and Privacy, Euro S and P 2020. IEEE, 474\u2013489."},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.22237\/jmasm\/1257035100"},{"key":"e_1_3_2_34_2","volume-title":"IoT Behavioral Monitoring via Network Traffic Analysis","author":"Sivanathan Arunan","year":"2020","unstructured":"Arunan Sivanathan. 2020. IoT Behavioral Monitoring via Network Traffic Analysis. Ph. D. Dissertation. UNSW."},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2018.2866249"},{"key":"e_1_3_2_36_2","unstructured":"Statista. 2023. Average Number Devices and Connections per Person Worldwide in 2018 and 2023. Retrieved from https:\/\/www.statista.com\/statistics\/1190270\/number-of-devices-and-connections-per-person-worldwide\/. [Accessed: 15.08.2025]."},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.3390\/bdcc2040037"},{"key":"e_1_3_2_38_2","doi-asserted-by":"crossref","first-page":"22","DOI":"10.1145\/3488659.3493777","volume-title":"DistributedML 2021 - Proceedings of the 2nd ACM International Workshop on Distributed Machine Learning","author":"Thompson Oliver","year":"2021","unstructured":"Oliver Thompson, Anna Maria Mandalari, and Hamed Haddadi. 2021. Rapid IoT device identification at the edge. In DistributedML 2021 - Proceedings of the 2nd ACM International Workshop on Distributed Machine Learning. Association for Computing Machinery, New York, NY, USA, 22\u201328."},{"key":"e_1_3_2_39_2","first-page":"1","volume-title":"2022 Seventh International Conference on Fog and Mobile Edge Computing (FMEC)","author":"Trad Fouad","year":"2023","unstructured":"Fouad Trad, Ali Hussein, and Ali Chehab. 2023. Using siamese neural networks for efficient and accurate IoT device identification. In 2022 Seventh International Conference on Fog and Mobile Edge Computing (FMEC). IEEE, 1\u20137."},{"key":"e_1_3_2_40_2","unstructured":"UK Parliament. 2023. Connected tech: smart or sinister? Retrieved from https:\/\/publications.parliament.uk\/pa\/cm5803\/cmselect\/cmcumeds\/157\/report.html. [Accessed: 07.04.2024]."},{"key":"e_1_3_2_41_2","first-page":"1","volume-title":"Digest of Technical Papers - IEEE International Conference on Consumer Electronics","author":"Wang Yong","year":"2022","unstructured":"Yong Wang, Bhaskar P. Rimal, Mark Elder, Sofia I.Crespo Maldonado, Helen Chen, Carson Koball, and Kaushik Ragothaman. 2022. IoT device identification using supervised machine learning. In Digest of Technical Papers - IEEE International Conference on Consumer Electronics. IEEE, 1\u20136."},{"key":"e_1_3_2_42_2","article-title":"Formulas Used by the \u201c Practical Meta-Analysis Effect Size Calculator \u201d","author":"Wilson David B.","year":"2017","unstructured":"David B. Wilson. 2017. Formulas Used by the \u201c Practical Meta-Analysis Effect Size Calculator \u201d. George mason university.","journal-title":"George mason university"},{"issue":"1","key":"e_1_3_2_43_2","first-page":"012071","article-title":"Classification and identification of unknown network protocols based on CNN and T-SNE","volume":"1617","author":"Xue Jingliang","year":"2020","unstructured":"Jingliang Xue, Yingchun Chen, Ou Li, and Fei Li. 2020. Classification and identification of unknown network protocols based on CNN and T-SNE. Journal of Physics: Conference Series 1617, 1 (2020), 012071.","journal-title":"Journal of Physics: Conference Series"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2964646"},{"key":"e_1_3_2_45_2","first-page":"55","volume-title":"2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications","author":"Zheng Yifeng","year":"2020","unstructured":"Yifeng Zheng, Arindam Pal, Sharif Abuadbba, Shiva Raj Pokhrel, Surya Nepal, and Helge Janicke. 2020. Towards IoT security automation and orchestration. In 2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications. IEEE, 55\u201363."}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3799713","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T16:34:17Z","timestamp":1776875657000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3799713"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,22]]},"references-count":44,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2026,8,31]]}},"alternative-id":["10.1145\/3799713"],"URL":"https:\/\/doi.org\/10.1145\/3799713","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"value":"1533-5399","type":"print"},{"value":"1557-6051","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,22]]},"assertion":[{"value":"2025-05-05","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-11-17","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-04-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}