## 3 Materials and Methods
### Employed Dataset  
Our study utilizes the MQTTset, a publicly available IoT dataset focused on MQTT communications, as described in [23] and available online [20]. The dataset is built using IoT sensors that operate on the MQTT protocol, with each component designed to replicate the characteristics of a real-world network. Specifically, the MQTT broker is implemented using Eclipse Mosquito v1.6.2, and the network infrastructure includes eight interconnected sensors. The sensors include temperature, light intensity, humidity, motion, CO-Gas, smoke, fan speed controller, and door lock sensors. The network is managed by an MQTT broker using Eclipse Mosquito. The dataset provides legitimate (benign) and malicious (attack) traffic data for MQTT-based IoT networks. Attacks included in the dataset are as follows [23]:  
1. Flooding Denial of Service (DoS): This attack targets the MQTT broker by establishing numerous connections and sending a high volume of messages using the MQTT-malaria tool ([[https://github.com/etactica/mqtt-malaria](https://github.com/etactica/mqtt-malaria)]([https://github.com/etactica/mqtt-malaria](https://github.com/etactica/mqtt-malaria)) accessed on 13 March 2025), aiming to prevent the broker from serving legitimate clients.
2. MQTT Publish Flood (flood): A single malicious device sends large amounts of MQTT data to exhaust server resources. This attack is implemented using the IoT-Flock tool.
3. SlowTfe (slowite): A slow DoS attack that initiates many connections to the MQTT broker with minimal bandwidth, using the MQTT service's connection slots and causing a denial of service. This attack demonstrates efficiency in resource usage while achieving the attack's objectives.
4. Malformed Data (malformed): This attack sends malformed CONNECT or PUBLISH packets to the MQTT broker using the MQTTSA tool, aiming to trigger exceptions and disrupt normal operations.
5. Brute Force Authentication (brute force): This attack attempts to crack MQTT user credentials using the MQTTSA tool and the rockyou.txt word list, simulating real-world brute force attacks to test the security of the MQTT authentication process.  
To support different research needs, the authors in [23] organized the dataset into three formats: imbalanced data (which contain a significantly higher proportion of legitimate traffic compared to malicious traffic), balanced reduced data (where legitimate traffic was reduced to match the total volume of malicious traffic), and balanced augmented data (where attack traffic was augmented to balance with legitimate traffic).  
In our study, we opted to use the balanced reduced data format. Our choice was guided by two primary considerations: (1) the need to mitigate the bias that often arises in imbalanced settings, where models tend to favor the majority class (legitimate traffic), potentially underperforming on minority (malicious) classes; and (2) the practical benefit of reduced computational cost and training time compared to the full 12 million entry imbalanced dataset. This format ensures that the total volume of legitimate traffic matches the sum of all malicious traffic instances, creating a 50:50 ratio between legitimate andmalicious traffic. However, it is important to note that legitimate traffic remains the majority class when compared to individual attack types, as showcased in Figure 2, which aligns more closely with real-world scenarios where legitimate traffic dominates. This approach allows us to balance the dataset for effective model training while maintaining a realistic representation of class distributions. Additionally, the reduced dataset facilitates more straightforward computation as it contains fewer instances (330,936) compared to the imbalanced data (12,081,189) and the balanced augmented data (20 million). MQTSet ensures that our study is grounded in realistic and comprehensive data, reflecting real-world IoT network conditions and potential security threats.