# Signature-Based Security Analysis and Detection of IoT Threats in Advanced Message Queuing Protocol
## 6 Analysis and Validation of Statistical Model for AMQP IoT Attack Detection
### Feature Selection and Weighting  
The statistical model leverages a carefully selected set of features to ensure robust performance in detecting known attack types. Features such as TCP flags, sequence numbers, payload lengths, and packet sizes were chosen based on their relevance in identifying anomalous traffic patterns. These features were selected for the following reasons:  
* TCP Flags: They indicate communication behaviors, such as connection initiation or termination, which are critical in identifying patterns related to DoS or MiTM attacks.
* Sequence Numbers: These help track packet flow, enabling the detection of anomalies like replay attacks or out-of-sequence packets.
* Payload Lengths: Variations in payload size can signal unusual traffic behaviors, often associated with brute force or protocol abuse.
* Packet Sizes: They serve as indicators of traffic irregularities, especially in cases of data exfiltration or malicious payload delivery.  
The weighting of these features in the model was determined through iterative testing to optimize detection accuracy while minimizing false positives. Features contributing most significantly to attack identification, such as TCP flags and sequence numbers, were assigned higher weights.  
Justification for this feature selection and weighting lies in their proven effectiveness in previous studies and their ability to generalize across a wide range of attack scenarios. Additionally, future work will explore integrating time-series data into the feature set to uncover evolving attack patterns over time, such as gradual resource exhaustion or incremental brute force attempts. Dynamic weighting schemes incorporating temporal trends could further improve model adaptability and precision.  
Signature Definition and Extraction Signatures are quantitatively defined and extracted from traffic data based on distinct patterns and statistical anomalies indicative of specific attack types. This process involves the following:  
* Feature-Based Quantification: Each signature is represented by a combination of features such as TCP flags, sequence numbers, payload lengths, and packet sizes. For instance, an SYN flood attack is characterized by a high frequency of SYN packets without corresponding ACK responses, while irregular sequence numbers may indicate replay attacks.
* Threshold Establishment: Statistical thresholds are set for each feature by analyzing normal traffic baselines. Any deviation beyond these thresholds is flagged as anomalous. For example, a spike in packet frequency or an unusual payload size may trigger an alert.
* Traffic Profiling: Traffic flows are monitored over time to identify repetitive patterns or behaviors indicative of malicious activity. These profiles form the foundation of the signature database.
* Empirical Validation: Known attack datasets and testbed simulations (e.g., using tools like hping3) are analyzed to identify consistent patterns that reliably distinguish malicious traffic from normal behavior. These findings are used to refine and validate the signature extraction process.