# Novel Feature Extraction Method for Detecting Malicious MQTT Traffic Using Seq2 Seq
## 5 Feature Extraction
### Preprocessing  
To detect malicious MQTT traffic, we used \(k\) consecutive packets \(\mathbf{p}_{ij}\) per client \(\mathbf{c}_{i}\). Each client sends several packets to its broker. \[\mathbf{c}_{i}=\left\{\mathbf{p}_{i,1},\mathbf{p}_{i,2},\ldots,\mathbf{p}_{i,n}\right\}\]  
We then extracted the source port index, TCP length, message type, keep alive, and connection ACK from each packet \(\mathbf{p}_{ij}\) as follows:  
\[\mathbf{p}_{ij}=\left\{\mathbf{source\;port\;index,\;tcp\;length,\; message\;type,keep\;alive,connection\;ack}\right\}\]  
Finally, the sequence data which we used are as follows:  
\[\mathbf{s}_{ij}=\left\{\mathbf{p}_{ij},\mathbf{p}_{ij+1},\ldots,\mathbf{p}_{ij+k-1}\right\}\] \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & \begin{tabular}{c} **Source Port** \\ **Index** \\ \end{tabular} & \begin{tabular}{c} **TCP Length** \\ \end{tabular} & \begin{tabular}{c} **Message** \\ **Type** \\ \end{tabular} & \
\begin{tabular}{c} **Keep** \\ **Alive** \\ \end{tabular} &
\begin{tabular}{c} **Connection** \\ **Ack** \\ \end{tabular} \\ \hline DoS Attack & O & - & - & - & - \\ Flood Attack & - & O & O & - & - \\ SlowTte Attack & - & - & - & O & - \\ Malformed Attack & - & - & O & - & - \\ Brute-force Attack & O & - & - & - & O \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Relation between MQTT attacks and features. For example, first, the sequence data of normal traffic were as follows:  
{(1001, -1, 1, -1, -1), (1001, -1, 2, -1, 0), (1001, -1, 3, -1, -1), (1001, -1, 12, -1, -1), (1001, -1, 13, -1, -1), (1001, -1, 3, -1, -1),...}  
Because the client had the first source port in the first packet, the source port index was 1001. Second, because the TCP packet size was less than 1000 bytes, we set the value to \(-1\). Third, because it was a connection request packet, the message-type value was one. Fourth, because the keep alive value was less than 1000, we set the value to \(-1\). In the second packet, the source port index was 1001. The TCP packet length was set to \(-1\). Because the message type was a connection ACK, the message-type value was set to two. The keep alive value was set to \(-1\). As it was a connection-accepted packet, the connection ACK value was set to zero. Because the third packet was a publish packet, the message-type value was set to three. The message-type value was set to 12 because the fourth packet was a ping request packet. In addition, because the fifth packet was a ping-ACK packet, the message-type value was set to 13. Second, the sequence data of the DoS attack were as follows:  
{(1001, -1, 1, -1, -1), (1002, -1, 1, -1, -1), (1003, -1, 1, -1, -1),..., (1001, -1, 2, -1, 0), (1002, -1, 2, -1, 0),...}  
Because the client used the first source port in the first packet, the source port index was 1001. Because the TCP length was less than 1000, it was set to \(-1\), and because it was a connected packet, the message type was one. In the second packet, the source port index was set to 1002 because the client used the second source port. In the third packet, the source port index was set to 1003 because the client used the third source port. In the fourth packet, the connection request was accepted because the message type was two and the connection ACK was zero. Third, the sequence data of the flood attack were as follows:  
{(1001, -1, 1, -1, -1), (1001, -1, 2, -1, 0), (1001, 1000, 3, -1, -1), (1001, 1000, 3, -1, -1), (1001, 1000, 3, -1, -1),...}  
In the third packet, because the client sent a publish packet whose message type was 3 and whose size was larger than 1000 bytes, the TCP length value was set to 1000. Subsequently, the client sent many publish packets whose TCP length was greater than 1000 bytes. Fourth, the sequence data of the SlowITe attack were as follows:  
{(1001, -1, 1, 10,000, -1), (1002, -1, 1, 10,000, -1), (1001, -1, 2, -1, 0), (1002, -1, 2, -1, 0), (1003, -1, 1, 10,000, -1), (1003, -1, 2, -1, 0),...}  
In the first packet, the client sent a connection packet with a source port index of 1001.