MQTT flow-tool choice changes clustering across public datasets
Original title: Do Flow-Generation Tools Matter? Unsupervised Characterization of MQTT Traffic Across Public Datasets
More than 380,000 flows from four datasets were built with Zeek-flowmeter, Argus, and NTLFlowLyzer, and no tool won every test.
A paper characterizes MQTT traffic at flow level rather than focusing on attack detection. Using captures from four public datasets, the authors built over 380,000 flows with Zeek-flowmeter, Argus, and NTLFlowLyzer, then clustered them with K-means, DBSCAN, and HDBSCAN, with and without PCA. Tool choice changed flow populations, feature structure, and clustering. Zeek-flowmeter performed best in several settings, especially K-means reduced to 10 PCA components, but no tool dominated every dataset, algorithm, and metric.
- Quality was measured with Silhouette score and Adjusted Rand Index.
- Zeek-flowmeter led in several settings with K-means and PCA to 10 components.
- The authors treat dataset, tool, preprocessing, algorithm, and metric as linked factors.
From the original article
1 min read at arxiv.orgMessage Queue Telemetry Transport (MQTT) is widely used in IoT environments due to its lightweight publish-subscribe design and suitability for resource-constrained networks.
By Mohammed Rashed · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.