Clear as MUD: Generating, Validating and Applying IoT Behavioral Profiles
Open accessAbstract
IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
This integration is particularly attractive in IoT/IIoT and SDN-enabled CPS environments, where gateways and controllers can dynamically enforce behavior-based policies derived from learned device profiles and traffic patterns.
“This integration is particularly attractive in IoT/IIoT and SDN-enabled CPS environments, where gateways and controllers can dynamically enforce behavior-based policies derived from learned device profiles and traffic patterns [60-62,64].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [62]
The Introduction (page unavailable) says IoT behavioral profiles allow networks to automatically configure device access restrictions, and §3.1 describes generating profiles from captured traffic flows. The paper also checks whether policies are compatible with SCADA settings (§4.2.3), but it does not establish dynamic enforcement by gateways and controllers in SDN-enabled CPS or IIoT environments. (LLM, conf=0.86)
Experimental — accuracy not yet measuredThe surveyed frameworks enable automated blocking, rerouting, and rate-limiting of malicious flows at the network layer by coupling IDS outputs with SIEM correlation rules, MUD-derived whitelists, SDN/OpenFlow policies, and switch-level filtering.
“By coupling IDS outputs with SIEM correlation rules, MUD-derived whitelists, SDN/OpenFlow policies, and switch-level filtering, the surveyed frameworks enable automated blocking, rerouting, and rate-limiting of malicious flows at the network layer [60-64].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [62]
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredThere are challenges in using MUD-based access policies, as many commercial IoT devices such as Amazon Echo may connect to a wide range of IP addresses.
“There are however challenges in using MUD-based access policies, as many commercial IoT devices such as Amazon Echo may connect to a wide range of IP addresses, as validated in [146].”
From Zero Trust Architecture (ZTA): A Comprehensive Survey (2022) · cites this paper as [146]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 17 · Cited by 103
Research works printed but not linked: 1
- [8]8. A. Hamza, D. Ranathunga, H. Habibi Gharakheili, M. Roughan, and V. Sivaraman. 2018. Clear as MUD: Generating, Validating and Applying IoT Behaviorial Profiles (Technical Report). ArXiv e-prints (April 2018). arXiv:cs.CR/1804.04358
- Authors
- Hamza, A., Ranathunga, D., Gharakheili, H. H., Roughan, M., & Sivaraman, V.
- Affiliations
- UNSW Sydney (AU)
- ARC Centre of Excellence for Mathematical and Statistical Frontiers (AU)
- Venue
- Proceedings of the 2018 Workshop on IoT Security and Privacy
- Publisher
- ACM
- Published
- 2018-08-07
- Pages
- 8-14
- OpenAlex
- W2887792592
- Semantic Scholar
- c2392b0963e813fdc4d9a181bced84458fa209b0
- Cited by
- 103
- References
- 17
- Citations by year
- 2026: 2 · 2025: 7 · 2024: 11 · 2023: 7 · 2022: 19 · 2021: 25 · 2020: 18 · 2019: 12 · 2018: 2
- FWCI
- 11.78
- Type
- conference paper
- Language
- en
- Open access
- gold
- doi.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- Adelaide Research & Scholarship (AR&S) (University of Adelaide) (submittedVersion)
- Funders
- Centre of Excellence for Mathematical and Statistical Frontiers (ACEMS)
- Australian Research Council (LP150100666)
- Google Faculty Research Awards
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
- Keywords
- Manufacturer Usage Description, Internet of Things security, Internet of Things, cyberattacks, critical infrastructure, IETF, equipment specifications
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
