# Security Analysis of the MQTT-SN Protocol for the Internet of Things
## 6 Threat Detector Proposed  
This section describes the deployment of the threat detector designed for IoT environments. As described above, the impact of these attacks when successful is considerable, and deploying typical detection systems can be complicated due to the scarce resources that IoT devices possess. Therefore, we propose a threat detector that is specifically designed to operate in IoT environments [39] and is based on a Complex Event Processing (CEP) engine. CEP is a technology capable of processing and correlating an enormous amount of data. The CEP engine receives simple events, which in this case are network packets. When these simple events meet the requirements set in the CEP rules, a complex event is triggered, which defines a situation of interest, which in this case, is a particular type of attack. CEP is used as the base engine because it has been demonstrated that it is possible to deploy this type of engine in IoT environments with few resources [40; 41; 42]. As a general rule, it is necessary for a domain expert to define these CEP rules. However, an architecture capable of generating CEP rules automatically has been designed [39]. This architecture is ideal for detecting the attacks in this paper, as they are novel attacks. This means that, in a real environment, the domain experts cannot define rules for these attacks because they do not know them. This architecture is based on the use of Principal Component Analysis (PCA) [43] and the Euclidean distance weighted with the explained variance ratio of each component of the PCA model. Each component condenses the information of different features of the events by means of linear relationships between them, and the components are linearly independent of each other. The explained variance ratio allows us to know the weight of each component. By doing so, we can weight each component more accurately when generating the rules. This allows us to reduce the dimensionality of simple events while characterizing the different families of attacks and to improve the performance of CEP rules in the network, computation, and memory domains. In addition, it also allows us to generate anomaly-detecting rules, which are ideal for detecting unknown attacks. \[f(x)= \begin{cases}1\text{ if }f(x)=\sum_{i}^{n}\sqrt{(x_{i}-m_{i})^{2}}\cdot rv _{i}\leq(\sum_{i}^{n}std_{i}\cdot rv_{i})+\alpha\\ 0\text{ if }f(x)=\sum_{i}^{n}\sqrt{(x_{i}-m_{i})^{2}}\cdot rv_{i}>(\sum_{i}^{n} std_{i}\cdot rv_{i})+\alpha\end{cases}  \tag{1}\]  
Equation (1) shows the definition of a threshold for a CEP rule generated by our proposal. Simple events, which are network packets in this case, are reduced with the PCA model. Once the reduced simple event \(x\) is available, it is sent to the CEP engine. The CEP engine calculates the difference of each component \(x_{i}\) of that reduced simple event with  
Figure 25: Received messages with attack versus those without attack. the mean of that component for each family \(m_{i}\) and weights it with the explained variance ratio of each component \(rv_{i}\). The \(\alpha\) element makes it possible to add a bias for attacks with elements that are very far from the mean. If the sum of these weighted differences is less than the sum of the standard deviations \(std_{i}\) weighted with the explained variance ratio of each component, it means that this element is part of that family. Otherwise, it is not part of that family. This allows the generation of rules that detect anomalies by using a rule that detects legitimate system behavior and makes it possible to generate anomaly detection rules when a single event does not correspond to any type of attack and is not part of the system's legitimate behavior. It is important to understand that the real novelty of this threat detector does not lie in Equation (1), which defines the detection threshold. The real novelty is the use of PCA to reduce single events, which reduces the computational load of the CEP engine. This is why this approach is novel and ideal in IoT environments.