Leveraging Benford’s Law for Effective Intrusion Detection in MQTT-IoT Networks

Heterogeneous smart devices communicate through different messaging protocols in IoT networks. Among them, Message Queuing Telemetry Transport (MQTT) is a widely used communication protocol due to its lightweight and publish-subscribe architecture. However, these features make it more vulnerable to various types of cyber-attacks. Therefore, effective intrusion detection systems must be designed to detect these threats in the IoT environment. Due to its limited memory and computational power, existing IDS models require significant modifications to work efficiently. To overcome these challenges, we proposed a lightweight IDS, specifically designed for resource-constrained devices. Our proposed IDS utilizes Benford’s Law and linear regression on MQTT network flows. Our extensive experiments conducted by using the MQTT-IoT-IDS2020 dataset have demonstrated promising results. The dataset supports analysis of both bidirectional and unidirectional MQTT network flows. It allows validation of our IDS model under different network conditions and attack scenarios. This approach effectively meets the unique demands of IoT networks and offers a practical and efficient solution for detecting malicious activities within these environments.