Diving Deep into MQTT: Unveiling Attack Patterns Through Clustering of Traffic Flows

Message Queue Telemetry Transport (MQTT) is considered the most significant protocol for IoT, standing out for its lightweight and high functionality in unreliable, limited resources networks. In this work, we analyze MQTT behavior using a collection of 211M benign and malicious packets from 6 datasets. Using 3 traffic flow generation tools to generate flows, we perform K-means clustering on the flows of each individual dataset to understand the traffic’s underlying behavior. Our results show that in 65% of the cases, the optimum number of clusters is 2. With only 1 dataset having two different classes and the other 5 having 4 or more, indicating high similarity between the samples from the different classes and difficulty in drawing clear boundaries between the traffic types. Further analysis using feature ranking shows that a single feature (Flow Duration) weighs on average 70-90%, thus reducing other features’ impact. Acknowledgment This work is supported by grant DISCOV- ERY (PID2023-148716OB-C33) funded by MCIU/AEI/10.13039/501100011033, and by the Comunidad de Madrid (Spain) under the project RAMONES-CM (TEC2024-COM504), co-financed by European Structural Funds (ESF and FEDER). This work is part of the I-Shaper Project (C114/23), a collaboration agreement between Instituto Nacional de Ciberseguridad (INCIBE) and Universidad Carlos III de Madrid. This initiative is being carried out within the framework of the Recovery, Transformation and Resilience Plan funds, funded by the European Union (Next Generation).