# Novel Feature Extraction Method for Detecting Malicious MQTT Traffic Using Seq2 Seq
## 2 Related Studies  
Cyber attacks are caused by malicious files or network traffic. Antivirus software [9] is used to prevent malicious files, whereas intrusion detection systems [10] are used to prevent malicious network traffic. In addition, deep learning technologies have been used to prevent cyber attacks due to malicious files and network traffic.  
Several methods have used deep learning to prevent malicious files. The first method involves detecting malicious files by converting them into images using convolutional network networks (CNNs) [11]. The second method involves detecting malicious files by extracting opcodes from them using recurrent neural networks [12]. The third method involves detecting malicious document files using deep learning [13]. The fourth involves detecting malicious scripts, such as PowerShell, using deep learning [14].  
In addition, several methods have used deep learning to prevent malicious network traffic. One such method involves detecting malicious network traffic using convolutional neural networks, autoencoders, and recurrent neural networks. One study used the NSLKDD dataset to simulate the detection of malicious network traffic [15]. Another method involves detecting malicious network traffic using a directed acyclic graph (DAC) and belief rule base (BRB) [16]. The third method involves detecting malicious network traffic by providing a hierarchical temporal- and spatial-feature-based detection system [17]. In this method, spatial and temporal features are learned using a convolutional neural network and long short-term memory (LSTM), respectively.  
Because IoT is widely used, several methods for detecting malicious IoT traffic have been proposed. A SlowTe attack was proposed to disrupt MQTT systems [5]. Additionally, MQTT traffic datasets, such as those for DoS, flood, SlowTe, malformed, and brute-force attacks, have been released [6]. To identify attacks, the following 33 feature types were used:  
{tcp.flags, tcp.time_delta, tcp.len, mqtt.conack.flags, mqtt.conack.flags.reserved, mqtt.conack.flags.sp, mqtt.conack.val, mqtt.conflag.cleansess, mqtt.conflag.gosswd, mqtt.conflag.qos, mqtt.conflag.reserved, mqtt.conflag.retain, mqtt.conflag.uname,  
Figure 1: Malicious MQTT Traffic Detection System Structure.  
mqtt.config.willflag, mqtt.configs, mqtt.dupflag, mqtt.hdrflags, mqtt.kalive, mqtt.len, mqtt.msg, mqtt.msgid, mqtt.msgtype, mqtt.proto_len, mqtt.protoname, mqtt.qos, mqtt.retain, mqtt.sub.qos, mqtt.suback.qos, mqtt.ver, mqtt.willmsg, mqtt.willmsg_len, mqtt.willtopic, mqtt.willtopic_len)  
However, the accuracy of this method was unsatisfactory. This study proposes a novel feature extraction method using only five features and the Seq2 Seq model. The accuracy of our method was 7.33% higher than that of previous methods.  
It is worth noting that [PERSON] et al. proposed a framework to detect anomalies in cyber physical systems [18]. They proposed a CNN with a Kalman filter-based Gaussian mixture model to detect inference, DoS, fuzzy, replay, and false data injection attacks. The attacks detected in this study are different from those investigated in our study. Furthermore, [PERSON] et.al. proposed a method for deploying evidence-based detection by using a trust authority to detect selfish nodes that do not participate in forwarding messages [19]. In addition, [PERSON] et al. proposed cryptographic algorithms to enhance data integrity in IoT systems [20]. However, their research goals were different from ours.