# Signature-Based Security Analysis and Detection of IoT Threats in Advanced Message Queuing Protocol
## 6 Analysis and Validation of Statistical Model for AMQP IoT Attack Detection
### Summary of the Statistical Model Performance
#### 6.5.4 Insights and Areas for Improvement  
This study serves as the starting point for a broader research effort. While the current statistical model effectively detects attack-specific traffic and maintains high precision for normal datasets, certain enhancements recommended by the reviewers were not included in this phase due to scope constraints, dataset limitations, and computational feasibility. The primary objective of this study was to validate a foundational AMQP security model, ensuring an efficient, interpretable, and scalable approach. However, our ongoing researchis actively working on integrating machine learning (ML) and deep learning (DL) techniques, which will address several of these recommendations. The following explains why certain aspects were not included and how future work will improve upon them:  
* Advanced Metrics (Precision, Recall, AUC, Confusion Matrices): While incorporating advanced evaluation metrics would provide a more detailed assessment of model performance, this study prioritized practical detection measures--specifically detection accuracy and false positive/negative rates--to validate the feasibility of AMQP-based intrusion detection. Including additional metrics would have required expanded dataset validation and computational adjustments. However, our ongoing ML/DL research will inherently incorporate these advanced evaluation methods to ensure more robust performance assessment.
* Time-Series Analysis for Attack Evolution Detection: This study focused on static and event-based attack patterns, which are the most common in AMQP environments. While time-series analysis would provide deeper insights into evolving attack behaviors, it requires specialized modeling techniques, significantly larger datasets, and increased computational resources. Implementing time-series-based detection would have expanded the project's scope beyond its primary objectives. However, our next research phase will employ Recurrent Neural Networks (RNNs) and Long Short-Term Memory (LSTM) models to analyze long-term AMQP attack patterns, addressing this gap.
* Detection of Subtle Attack Patterns (e.g., Misclassified DoS Traces): The current model is designed to detect major attack categories in AMQP-based IoT networks. Identifying subtle attack patterns, such as low-rate DoS attacks misclassified as normal traffic, requires adaptive thresholding and more sophisticated anomaly detection methods. These refinements were excluded to maintain the study's focus on validating AMQP security at a fundamental level. However, our ongoing research explores deep learning-based anomaly detection techniques, such as autoencoders and Generative Adversarial Networks (GANs), to improve detection of stealthy, low-profile attacks.
* Granular Malicious Packet Classification for Brute Force and MitM Attacks: Improving the granularity of malicious packet classification requires more refined feature extraction and deep multi-label classification approaches. While the current study prioritizes broader attack categorization, our ongoing research is incorporating Convolutional Neural Networks (CNNs) and Transformer-based models to automatically extract deeper network features, enabling more precise attack classification. These enhancements were not included in this study due to dataset limitations and the need for additional training data, which are currently being curated.  
While these enhancements were beyond the scope of this study, they form the core direction of our ongoing research. By leveraging ML/DL-driven methodologies, future iterations of this work will provide a more adaptive and intelligent framework for securing AMQP-based IoT environments.