## 2 Related Work  
In this section, we provide a brief overview of recent works on IoT security, with a particular emphasis on methods to secure the MQTT protocol. Several studies have been conducted on this subject matter, and anomaly detection using ML has gained traction as a method for identifying malicious traffic within MQTT-based IoT networks. For instance, the authors in [21] proposed an intelligent and lightweight detection scheme to identify low-rate distributed denial of service (LR-DDoS) attacks in a software-defined IoT environment. Their approach leveraged ML models to analyze traffic patterns and distinguish between legitimate and malicious activities. Their research evaluated the performance of four different machine learning models utilizing the LRDDoS-MQTT-2022 dataset: Decision Tree Classifier (DTC), Multilayer Perceptron (MLP), Artificial Neural Networks (ANNs), and Naive Bayes classifier (NBC). The authors demonstrated that the Decision Tree Classifier achieves an impressive accuracy of 99.5%, outperforming other models regarding prediction rates and detection speed. [PERSON] et al. [22] introduced a simulated dataset, MQTT-IoT-IDS2020, which includes benign and attack instances, to train and evaluate the models. Their research evaluated six machine learning models: Decision Tree (DT), Random Forest (RF), k-nearest Neighbor (KNN), Naive Bayes (NB), Support Vector Machine (SVM), and Multilayer Perceptron (MLP). The authors analyzed packet-based, unidirectional, and bidirectional flow features to assess model performance. Their findings suggest that flow-based features provide better detection capabilities than packet-based features for MQTT-specific attacks. The study presented in [16] focuses on enhancing the security of IoT systems that utilize the MQTT protocol through multiclass classification techniques. The authors employed both ensemble methods and deep learning (DL) models, specifically recurrent neural networks (RNNs), to classify attack types. The study used a dataset containing frames under attack within an IoT system using the MQTT protocol. The authors demonstrated that RRNs, in particular, provide satisfactory results in identifying various attack types, which is essential for developing robust intrusion detection systems (IDSs). However, the study did not address the computational complexity of deploying DL models, such as RNNs, on resource-constrained IoT devices. While these models exhibit high accuracy, their computational demands could pose significant challenges for real-time deployment and operation in environments with limited processing power and memory capacity. [PERSON] et al. [23] introduced the MQTTset dataset, which includes legitimate traffic and various cyber-attacks against MQTT networks. To validate the dataset, the authors employed various ML algorithms, such as NB, MLP, RF, GB, NN, and DT, to identify security threats. However, while the MQTTset dataset is a valuable resource, the methodology used to evaluate it needs improvement. Firstly, the authors did not employ feature reduction techniques. Feature reduction is crucial in machine learning as it helps simplify models, reduce overfitting, and improve computational efficiency. Secondly, the study did not involve hyperparameter tuning. Hyperparameter tuning is essential for optimizing machine learning models, as it consists of selecting the best set of parameters that maximize the model's performance. While they achieved high accuracy, without this step, the models used in the study may have not been operating at their full potential. [PERSON] et al. [5] adapted the MQTTset dataset for binary classification. They proposed an IDS based on ensemble learning (EL) methods, explicitly bagging, boosting, and stacking. These methods involve training multiple machine learning models independently on random subsets of the training data and then combining their predictions to improve overall performance.