HGExplainer: Heterogeneous Graph Explainer for IoT Device Identification

IoT device identification is vital for network asset and security management. However, existing methods use statistical features that can not identify IoT devices accurately in complex network environments. GraphIoT proposes using non-statistical features and building a heterogeneous graph neural network to identify IoT devices accurately. However, heterogeneous graph neural networks lack interpretability, which reduces trust in the model. Besides, it is difficult to deploy on resource-constrained devices, limiting the broad application of IoT device identification. To make IoT device identification interpretable, easy to deploy, and with high accuracy, we get the interpretation results of GraphIoT through interpretability and further build the rule set based on the interpretation results. Considering there is no suitable interpreter for GraphIoT with many nodes and edges, we propose HGExplainer, which reduces the time complexity by splitting the interpretation target into important relation solving and edge solving and uses a novel solution method, ExpandTree. Then, we also designed a rule extractor, which can build rule sets based on the interpretation results. Experimental results on Yourthings and UNSW datasets show that HGExplainer can build high fidelity, concise sample-level explanations in less than 3 seconds, and the established rule set can precisely identify IoT devices.