Publication Details
Abstract
Objective: The study examines cybersecurity threats in IoT environments used in the industrial and business sector by analyzing characteristics of network traffic and attacks in the MQTT protocol. The objective of the research is to look at the differences between legitimate traffic and various classes of attacks, to potentially support future AI-based threat detection. Method: A quantitative exploratory research design was selected, and the dataset was the MQTTEEB D processed, standardized data with 634644 observations equally distributed among legitimate traffic, denial-of-service attack, SlowITe attack, malformed data injection, brute force attack, and MQTT publish flooding. To explore relationships between the variables of the TCP and MQTT communications, descriptive statistics, distribution of the features, correlation analysis, and multivariate visualization techniques were used. Results: The results show that some network characteristics have characteristic patterns of behavior for each traffic type. However, TCP packet length and MQTT QoS show meaningful differences in the classes of attacks and legitimate communications, with comparatively small discriminatory capability for TCP time delta. Correlation analysis has been used to identify strong correlations between features of the MQTT protocol and interesting correlations between application layer and packet-level properties. Malicious traffic is also spread across wider communication patterns than legitimate traffic on average, with some patterns that overlap between categories, as seen in the integrated visual assessment. Novelty: The results indicate that only a combination of TCP and MQTT features might be useful for threat identification for cybersecurity monitoring. Although the study does not build or test predictive models, it presents a foundation for future research in AI-powered cybersecurity in industrial and business IoT environments and gives an evidence-based understanding of MQTT traffic behaviour.