Process-Based Intrusion Detection Method for IoT System with MQTT Protocol
Mohd Anuaruddin Bin Ahmadon, Yamaguchi Naofumi, Shingo Yamaguchi · 2019
Due to the scalability of MQTT network, the increasing number of devices and network complexity cause the detection of anomalies to be less accurate. In this paper, we proposed a detection method to detect anomalies (i.e. attack and fault) that are hard to detect due to its minor deviation from the normal behavior. We model the network behavior with a process tree, then compare the similarity with the behavior of the observed network events. We showed that by partially checking the behavior of network to the depth of events and its execution relations, we can effectively detect minor deviations.