Threat Detection in Internet of Things Messaging Protocol: Leveraging the MQTTEEB-D Realistic Dataset

Abstract

The ubiquity of Internet of Things (IoT) devices has critically expanded the cyberattack surface, exposing inherent vulnerabilities in lightweight messaging protocols such as MQTT. This study rigorously evaluates machine learning (ML) techniques for threat detection using MQTTEEB-D, a dataset capturing diverse cyberattacks (DoS, MQTT Publish Flooding, SlowITe, Brute Force, Malformed Data) within a realistic IoT deployment. Our analysis reveals that a Random Forest (RF) classifier achieves, with 0.99 accuracy for binary (malicious vs. legitimate) classification and 0.97 accuracy for multi-class threat identification. In comparison, while the Multi-Layer Perceptron (MLP) achieves a notable 0.90 accuracy, it underperforms RF and struggles with high false-positive rates on legitimate traffic. Conversely, the Recurrent Neural Network (RNN) achieved only 0.74 accuracy, demonstrating that static packet features provide superior discriminative power compared to temporal dependencies for MQTT threat detection.These findings underscore the necessity of using realistic datasets to validate intrusion detection systems and highlight the efficacy of well-tuned ensemble models over more complex neural networks for securing MQTT-based IoT ecosystems.