Denial of Services (DoS) Attack Detection and Classification for MQTT-IoT Protocol Using Deep Learning Model

Abstract

The network of Things (IoT) has witnessed rapid expansion, revolutionizing communication among physical devices for data exchange in diverse systems across the world. Their functionality effectively relies on data communication protocols. In the IoT setting MQTT is a publish-subscribe data communication protocol scenario that facilitates message exchange services among CI including industrial, residential, and telecommunication applications. Despite its benefits, the surge of MQTT adoption in IoT amplifies the vulnerability to cyber security attacks, notably DoS attacks which are known to cause service disruption in legacy systems. These attacks, capable of overloading MQTT brokers with malicious traffic, disrupt critical services and render networks unreliable. In this thesis study, we develop a DL model for detecting these attacks in the MQTT-IoT networks which is becoming more helpful and crucial for protecting the MQTT networks from these attacks. Currently, DL outperforms better than the rule and anomaly-based for detecting and classifying DoS security assaults. Leveraging DL and feature selection mechanisms, the proposed method aims to identify anomalous patterns in MQTT traffic. We use Chi-square and correlation-based to select the most informative features to train our candidate model RNN, LSTM, and MLP to reduce computational overhead. Model evaluation is conducted on a real-world MQTT dataset containing DoS attacks and normal traffic which is publicly available on the Kaggle repository for research purposes. The candidate model has experimented with similar parameters and evaluation metrics to identify the best model for detection and classification of the DoS attack in MQTT network flows to ensure the best model with high accuracy performance and small miss-classification error. Accordingly, we train the models on 70% and test the model performance on 30% to ensure it is generalizability and to compare against the baseline paper for detection and classification of DoS attacks in the MQTT network environment. The experimented result illustrated that LSTM attained 99.52% accuracy and 0.0047 overall misclassification errors than candidate models of RNN and MLP. Our suggested LSTM model has improved by 0.58% accuracy than the CNN-LSTM, by 4.94% accuracy than NN, and by 3.58% than the MLP model on MQTTset datasets, as we have observed from the related models.