The detection of attacks on MQTT networks using machine learning models

The rapid development of the Internet of Things (IoT) has enabled a large number of devices to share data over networks, paving the way for significant advancements across many industries. Various communication protocols are used to ensure the efficient exchange of data among IoT devices. Among these protocols, MQTT (Message Queuing Telemetry Transport) stands out as an ideal communication mechanism for IoT systems due to its low bandwidth requirements and lightweight structure. However, the widespread adoption of the MQTT protocol has also exposed these networks to various security vulnerabilities, making them susceptible to cyberattacks. This study examines the use of machine learning techniques to detect attacks specific to MQTT networks and aims to identify potential threats. The study focuses particularly on the SlowITe attack and the SlowTT attack, which was integrated into the dataset later. The dataset used, called MQTTset, did not originally include data related to SlowTT attacks, so this data was added during the course of the study. To ensure a balanced dataset, %50 of the dataset consists of normal traffic data, while the remaining %50 is equally divided among SlowITe, SlowTT, Brute Force, Malformed, DoS, and Flood attacks. The use of a balanced dataset eliminates the problem of models overfitting to the dominant class in imbalanced datasets, ensuring fair evaluation of all classes. As a result, the performance metrics of the algorithms become more reliable. Although some models exhibited lower performance, using a balanced dataset allowed for more accurate class distribution and realistic outcomes. In this study, comprehensive experiments were conducted using various machine learning algorithms such as Random Forest, XGBoost, LightGBM, DNN (Deep Neural Network), and CatBoost on a balanced dataset. In the initial phase, Random Forest demonstrated the highest success rates in tests performed on the extended MQTTset dataset. While other models also exhibited acceptable performance, the DNN model showed relatively lower success rates. In the second phase of the study, new features (TCP window size and frame time delta) were added to the dataset, and the same models were tested again using this new dataset. With the addition of these features, a general improvement in model performance was observed, and Random Forest, XGBoost, LightGBM, and CatBoost achieved high success rates. Additionally, LIME (Local Interpretable Model-agnostic Explanations) and SHAP (SHapley Additive exPlanations) methods were used to further analyze the results of the models and determine which features contributed the most to model performance. SHAP analysis enhanced the interpretability of the machine learning models used in attack detection and clearly identified the features that contributed most significantly to the detection process. In conclusion, this study demonstrates the effectiveness of machine learning-based approaches in detecting attacks on MQTT networks. It was observed that the addition of new features significantly improved detection performance and that the SHAP method provided clearer insights into which features were most critical in the detection process. The methods used in this study offer significant contributions to securing IoT networks and provide effective solutions for the early detection of potential attacks.