Methodology for Characterizing Network Behavior of Internet of Things Devices

NIST outlines a methodology for understanding and documenting the network behavior of Internet of Things (IoT) devices. By capturing traffic across different life-cycle stages—setup, normal operation, and decommissioning—organizations can generate accurate Manufacturer Usage Description (MUD) files to guide access control. The report introduces MUD-PD, an open-source tool that streamlines this process, making it easier to characterize device behavior and build reliable security profiles. This approach strengthens defenses against IoT-related risks while also supporting research into privacy, machine learning, and automated network management.