Newest papers

Do Flow-Generation Tools Matter? Unsupervised Characterization of MQTT Traffic Across Public Datasets

Mohammed Rashed, Carlos García-Rubio, Celeste Campo · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.29774 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

Message Queue Behaviour Single Component Telemetry Transport (MQTT) ツールは、リソース評価制限されたネットワークのための軽量なパブリッシュ・サブスクリプション設計と適合性のために、IoT環境で広く使用されています。現在の MQTT セキュリティ研究は、攻撃を検出し、流量分類パフォーマンスを最適化することに焦点を当てていますが、この作業は、パッケージンググループ、流量終了、および機能に関するツール特有の決定を通じて異なる視点をとります。 UQTT パッケージは、流量レベルで 4 つのパブリッシュ MQTT トラフィックの特徴を示します。これらの視点は、フロー・ジェネレーションがツール依存性

Machine translation (Meta M2M100); the English original follows.

Abstract

Message Queue Telemetry Transport (MQTT) is widely used in IoT environments due to its lightweight publish-subscribe design and suitability for resource-constrained networks. While current MQTT security studies mainly focus on detecting attacks and optimizing classification performance, this work takes a different perspective by presenting a cross-dataset, tool-aware characterization of MQTT traffic at the flow level. This perspective is motivated by the fact that flow-generation is tool-dependent: flows are not directly observed in packet captures, but are constructed through tool-specific decisions about packet grouping, flow termination, and feature export. Using packet captures from 4 public MQTT datasets, we generated over 380K flows with 3 open-access flow-generation tools: Zeek-flowmeter, Argus, and NTLFlowLyzer. We analyzed the tool-specific flows using K-means, DBSCAN, and HDBSCAN, with and without PCA-based dimensionality reduction. We measured clustering quality using 2 metrics: (1) Silhouette score to assess label-independent cluster compactness and separation, and (2) Adjusted Rand Index to measure agreement with available labels. Our results show that the choice of flow-generation tool affects the resulting flow population, feature-space structure, and clustering behavior. Zeek-flowmeter achieves the best performance in several settings, particularly with K-means and PCA reduction to 10 components. Yet, no single tool consistently dominates across all datasets, algorithms, and evaluation metrics. These findings show that flow-level MQTT analysis should treat the dataset, flow-generation tool, preprocessing choices, clustering algorithm, and evaluation metric as interconnected experimental factors.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, MQTT, Cluster analysis, Data mining, Network packet, Preprocessor

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange