Newest papers

Do Flow-Generation Tools Matter? Unsupervised Characterization of MQTT Traffic Across Public Datasets

Mohammed Rashed, Carlos García-Rubio, Celeste Campo · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.29774 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

La herramienta Message Queue Behavior Telemetry Transport (MQTT) se utiliza ampliamente en entornos de IoT debido a su diseño de publicación-subscripción ligero y su aptitud para redes de evaluación de recursos. Mientras que los estudios de seguridad actuales de MQTT se centran principalmente en detectar ataques y optimizar el rendimiento de flujo, este trabajo toma una perspectiva diferente presentando un conjunto de datos cruzado, caracterización de herramientas del tráfico de MQTT en el nivel de flujo. Esta perspectiva está motivada por el hecho de que la generación de flujo es dependiente de la estructura de la herramienta: los flujos no se observan directamente en las capturas de paquetes, sino que se construyen a través de decisiones específicas de la herramienta sobre el packeting, la terminación de flujo y

Machine translation (Meta M2M100); the English original follows.

Abstract

Message Queue Telemetry Transport (MQTT) is widely used in IoT environments due to its lightweight publish-subscribe design and suitability for resource-constrained networks. While current MQTT security studies mainly focus on detecting attacks and optimizing classification performance, this work takes a different perspective by presenting a cross-dataset, tool-aware characterization of MQTT traffic at the flow level. This perspective is motivated by the fact that flow-generation is tool-dependent: flows are not directly observed in packet captures, but are constructed through tool-specific decisions about packet grouping, flow termination, and feature export. Using packet captures from 4 public MQTT datasets, we generated over 380K flows with 3 open-access flow-generation tools: Zeek-flowmeter, Argus, and NTLFlowLyzer. We analyzed the tool-specific flows using K-means, DBSCAN, and HDBSCAN, with and without PCA-based dimensionality reduction. We measured clustering quality using 2 metrics: (1) Silhouette score to assess label-independent cluster compactness and separation, and (2) Adjusted Rand Index to measure agreement with available labels. Our results show that the choice of flow-generation tool affects the resulting flow population, feature-space structure, and clustering behavior. Zeek-flowmeter achieves the best performance in several settings, particularly with K-means and PCA reduction to 10 components. Yet, no single tool consistently dominates across all datasets, algorithms, and evaluation metrics. These findings show that flow-level MQTT analysis should treat the dataset, flow-generation tool, preprocessing choices, clustering algorithm, and evaluation metric as interconnected experimental factors.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, MQTT, Cluster analysis, Data mining, Network packet, Preprocessor

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange