## 1 Introduction  
Technological advances like the Internet of Things (IoT) continue to revolutionize various industries. IoT enables seamless connectivity and automation, facilitating the interconnection of devices for real-time data exchange and intelligent decision-making [1]. IoT networking protocols are essential to ensure that devices interact efficiently and effectively within an IoT network. The standard protocols utilized in IoT include but are not limited to Message Queuing Telemetry Transport (MQTT) protocol, Constrained Application Protocol (CoAP), Advanced Message Queuing Protocol (AMQP), and Hypertext Transfer Protocol/Secure (HTTP/HTTPS) [2, 3, 4, 5]. Each protocol is applied to its most suitable IoT application based on specific requirements such as power consumption, bandwidth, and security [2, 3]. MQTT, in particular, has gained widespread adoption in IoT applications due to its lightweight and efficient publish-subscribe architecture, establishing itself as a de facto standard for data transmission [6, 7, 8]. MQTT's adaptability is demonstrated in many IoT applications, from smart home systems to industrial automation, healthcare monitoring,automotive, manufacturing, and telecommunications [9]. It is particularly prevalent in applications requiring reliable and low-latency communication [10], and the remote access feature further enhances its value in these applications [6; 9]. Despite its advantages, MQTT is not without its limitations. Its lightweight design, while beneficial for resource-constrained IoT devices, does not inherently provide built-in security mechanisms (e.g., encryption, authentication, authorization) [5; 10]. The responsibility for implementing appropriate security features is left to the implementor [6]. However, that approach has practical limitations. Several studies highlight that attempts to address these security gaps, such as employing transport layer security (TLS) for encryption and OAuth for authentication, add complexity and computational overhead to the system [7; 8]. Consequently, researchers have found that many users deploy MQTT brokers over the default TCP port 1883 (unencrypted connections) instead of MQTT over SSL/TLS port 8883, which is a secure alternative [8; 11]. These shortcomings pose significant security challenges. The MQTT-based IoT system is susceptible to various security threats and attacks, compromising the safety and integrity of data transmitted across the network. Some prevalent MQTT threats include unauthorized access, data tampering, information exposure, escalation of privileges, broker software vulnerabilities, attacks such as man-in-the-middle (MitM), denial of service (DoS), replay, and brute force attacks [4; 7; 12; 13]. For instance, without encryption, attackers can intercept and alter data transmitted between devices and the broker in man-in-the-middle attacks. The reliance on a central broker in MQTT also introduces a single point of failure and a potential attack target [10]. With DoS, attackers overwhelm the broker with an excessive number of connections or messages, causing legitimate clients to be denied service. A compromised broker can lead to significant data loss, service interruptions, and even control over the connected IoT devices, posing severe risks to both safety and functionality. Moreover, the remote access capabilities amplify the attack surface [14]. Exposing remote services is a common attack vector in industrial environments [15]. Attackers can exploit security flaws, such as misconfigurations or weak credentials, in these services to gain unauthorized access. Given the vulnerabilities inherent in MQTT-based IoT networks, exploring effective methods for detecting and mitigating security threats is imperative. Anomaly detection, mainly through traffic classification backed by artificial intelligence (AI)/machine learning (ML) techniques, has garnered significant attention as a practical and promising approach for enhancing network security in this context [4; 5; 16].