Newest papers

Do Flow-Generation Tools Matter? Unsupervised Characterization of MQTT Traffic Across Public Datasets

Mohammed Rashed, Carlos García-Rubio, Celeste Campo · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.29774 · cited by 0 works (OpenAlex) · open-access PDF

Arabic

تستخدم أداة Message Queue Component Telemetry Transport (MQTT) على نطاق واسع في بيئات الهواتف الذكية بسبب تصميمها الضوئي للرسالة وتطبيقها لمواصفات الموارد. في حين أن دراسات أمن MQTT الحالية تركز بشكل رئيسي على اكتشاف الهجمات وتحسين أداء التخزين، فإن هذا العمل يستخدم وجهة نظر مختلفة من خلال عرض مجموعة البيانات المتنوعة، والتخزين على نطاق أداة البيانات من MQTT على مستوى التخزين. وهذه وجهة نظر تؤدي إلى حقيقة أن نموذج التخزين يعتمد على أدوات التخزين المفتوحة: لا يتم الاحتفاظ بالهجمات مباشرة في تسجيل البطاقات، ولكن يتم بناءها من خلال اتخاذ قرارات محددة على الأ

Machine translation (Meta M2M100); the English original follows.

Abstract

Message Queue Telemetry Transport (MQTT) is widely used in IoT environments due to its lightweight publish-subscribe design and suitability for resource-constrained networks. While current MQTT security studies mainly focus on detecting attacks and optimizing classification performance, this work takes a different perspective by presenting a cross-dataset, tool-aware characterization of MQTT traffic at the flow level. This perspective is motivated by the fact that flow-generation is tool-dependent: flows are not directly observed in packet captures, but are constructed through tool-specific decisions about packet grouping, flow termination, and feature export. Using packet captures from 4 public MQTT datasets, we generated over 380K flows with 3 open-access flow-generation tools: Zeek-flowmeter, Argus, and NTLFlowLyzer. We analyzed the tool-specific flows using K-means, DBSCAN, and HDBSCAN, with and without PCA-based dimensionality reduction. We measured clustering quality using 2 metrics: (1) Silhouette score to assess label-independent cluster compactness and separation, and (2) Adjusted Rand Index to measure agreement with available labels. Our results show that the choice of flow-generation tool affects the resulting flow population, feature-space structure, and clustering behavior. Zeek-flowmeter achieves the best performance in several settings, particularly with K-means and PCA reduction to 10 components. Yet, no single tool consistently dominates across all datasets, algorithms, and evaluation metrics. These findings show that flow-level MQTT analysis should treat the dataset, flow-generation tool, preprocessing choices, clustering algorithm, and evaluation metric as interconnected experimental factors.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, MQTT, Cluster analysis, Data mining, Network packet, Preprocessor

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange