Identifying communication sequence anomalies to detect DoS attacks against MQTT

Abstract

Internet of Things (IoT) application layer protocols govern how applications running on IoT devices communicate and exchange data with each other. One popular IoT application layer protocol is the Message Queue Telemetry Transport (MQTT). It works on the publish–subscribe network model, allowing resource-constrained IoT devices to communicate with minimal bandwidth and computational power. Recently, a few works discussed DoS/DDoS attacks against the MQTT protocol, such as Basic CONNECT Flooding, Delay CONNECT Flooding, Invalid Subscription Flooding, CONNECT Flooding with WILL Payload and TCP SYN Flooding exploitation. However, the known defense approaches cannot detect all categories of DoS/DDoS attacks against MQTT. To bridge this research gap, we propose a detection approach in this paper that identifies anomalies in the MQTT communication sequence to detect anomalous requests. We test the proposed approach on a recent DoS/DDoS-MQTT-IoT dataset containing the traces of different DoS/DDoS attacks against the MQTT protocol. The experimental findings demonstrate that the approach can accurately detect malicious MQTT requests in real-time with slight overhead on computational resources.