eMQTT Traffic Generator for IoT Intrusion Detection Systems

Abstract

The development of effective Intrusion Detection Systems (IDS) for Internet of Things (IoT) environments is constrained by the absence of realistic, large-scale datasets, particularly for the Message Queuing Telemetry Transport (MQTT) protocol, which is prevalent in industrial IoT. Existing datasets are frequently limited in scope, imbalanced, or do not capture MQTT-specific attack patterns, thereby impeding the training of accurate machine learning models. To address this gap, the extensible Message Queuing Telemetry Transport (eMQTT) Traffic Generator is introduced as a modular platform capable of simulating both legitimate MQTT communication and targeted denial-of-service (DoS) attacks. The framework features a scalable and reproducible architecture that incorporates protocol-aware attack modeling, automated traffic labeling, and direct export of datasets suitable for machine learning applications. The system produces standardized, configurable, repeatable, and publicly accessible datasets, thereby facilitating reproducible research and scalable experimentation. Experimental validation demonstrates that the simulated traffic aligns with established DoS behavior models. Two high-volume datasets were generated: one representing normal MQTT traffic and another emulating CONNECT-flooding attacks. Machine learning classifiers trained on these datasets exhibited strong performance, with gradient boosting models achieving over 95% accuracy in distinguishing benign from malicious traffic. This work offers a practical solution to the scarcity of datasets in IoT security research. By providing a controlled, extensible, and reproducible traffic-generation platform alongside validated datasets, eMQTT enables systematic experimentation, supports the advancement of IDS solutions, and enhances MQTT security for critical IoT infrastructures.

1. Introduction

The number of devices connected to the internet continues to increase rapidly, primarily driven by the proliferation of smart devices such as sensors for smart homes, healthcare, and industrial automation. These devices are now deployed in applications extending beyond health systems and advanced manufacturing, including intelligent cities [1]. Consequently, billions of devices are interconnected, continuously exchanging messages and generating substantial volumes of data. The simplicity and limited capabilities of IoT hardware and software render these devices increasingly susceptible to a wide range of cyberattacks. Furthermore, the complexity and heterogeneity of IoT networks, combined with limited computational resources and reliance on outdated firmware, make them attractive targets for adversaries. Attacks may occur at multiple levels, including device tampering, network-based attacks such as man-in-the-middle and DoS/DDoS, firmware-level compromises, and cryptographic exploits such as side-channel attacks [2,3]. The Message Queuing Telemetry Transport (MQTT) protocol, widely adopted for its simplicity, has consequently become a frequent target for malicious exploitation.

Given the critical role of IoT devices in daily operations, maintaining the confidentiality, integrity, and availability of MQTT-based communications is essential for the continuous operation of critical infrastructure. Cyber threats are an inherent risk in modern communication systems. In MQTT-based data exchange environments, attackers may exploit vulnerabilities not only within the MQTT protocol but also in supporting services and protocols such as DNS and HTTP [4]. IoT gateways and brokers, which facilitate communication between devices and applications, are particularly attractive targets for adversaries [5]. These nodes can be compromised through techniques such as brute-force attempts [6], traffic floods [7], malformed messages, or slow-rate DoS attacks [8], all of which can rapidly undermine the reliability and stability of IoT systems [9]. For example, the SlowITe attack exploits a vulnerability in the MQTT 3.1.1 protocol to cause denial of service with minimal resources [10]. Given the potential for delayed detection to result in irreversible damage, real-time and accurate intrusion detection is essential in IoT-based communication systems.

Intrusion detection in IoT systems continues to face a significant challenge: training datasets are frequently unbalanced [11,12]. Typically, normal traffic dominates these datasets, while actual attack samples are scarce. This imbalance impedes the ability of machine learning models to identify rare or unusual attacks, which are often the most critical to detect. Furthermore, many existing datasets focus on a limited set of attack types, such as those associated with botnets or Telnet-based traffic, restricting their utility for developing intrusion detection system (IDS) solutions capable of identifying a broader spectrum of threats [13]. Advanced persistent threat (APT) actors may also operate within IoT environments, yet current IDS systems often fail to detect them due to the lack of sufficiently broad and scalable datasets.

In contrast to widely used general-purpose intrusion detection datasets such as DARPA 1999, KDD Cup 1999, UNSW-NB15, and CICIDS, which do not model MQTT-specific communication patterns, the eMQTT framework is specifically designed for MQTT-based IoT and IIoT environments [14]. Traditional datasets fail to capture the semantics of MQTT control packet exchanges, including CONNECT and CONNACK interactions, or broker overload dynamics, which are essential for evaluating protocol-aware attacks. Even IoT-oriented datasets, such as Bot-IoT, primarily focus on TCP-, UDP-, or HTTP-based botnet activity and thus overlook application-layer MQTT behavior. Although recent resources like MQTTset and MQTT-IoT-IDS2020 represent progress, they remain static datasets with limited extensibility [15].

To address these challenges, the extensible Message Queuing Telemetry Transport (eMQTT) traffic generator is introduced. The extensible nature of its modular design enables straightforward integration of new IoT device profiles and additional attack scenarios, such as brute-force attempts and malformed data injection, within a scalable, software-defined environment. This adaptable architecture allows the framework to evolve in response to emerging security threats and changing network conditions. Consequently, eMQTT serves as a sustainable and flexible experimental platform that supports long-term research in IoT intrusion detection. This capability directly addresses the issue of class imbalance, a persistent challenge in IoT intrusion detection research. The framework also supports full-packet capture, structured feature extraction, and reproducible experiment configuration, facilitating systematic replication under defined attack intensities and durations. Beyond data generation, eMQTT provides an integrated experimentation environment that combines sensor-level simulation, protocol-aware attack injection, packet capture, structured data transformation, and export for both anomaly detection and attack classification. This end-to-end approach establishes a reproducible and extensible foundation for evaluating advanced intrusion detection strategies in industrial IoT settings.

In response to these limitations, the eMQTT Traffic Generator (eMQTT) is proposed as a solution. This tool provides a testbed environment for simulating IoT sensors, generating traffic that is realistic and indistinguishable from MQTT traffic observed in physical IoT systems. The generator enables the construction of balanced and extensible attack scenarios by incorporating a wide range of use cases and typical traffic patterns. Its modular architecture supports scalability across both sensing and application layers, ensuring adaptability. The system employs Tshark for efficient network packet capture and produces outputs in formats such as PCAP and CSV for downstream analysis. By integrating flow-based and service-based features, the generator offers comprehensive representations for anomaly detection, intrusion identification, and attack classification.

The adoption of synthetic traffic generation via eMQTT is motivated by the inherent limitations of existing real-world datasets, which are often outdated, limited in scale, or lack the diverse labeling necessary for robust machine learning training. Employing a software-defined synthetic approach enables the simulation of complex, high-volume industrial environments that are reproducible and not subject to the privacy constraints of real-world data capture. This methodology facilitates the creation of balanced datasets that include rare or emerging attack vectors, providing a controlled and realistic benchmark for evaluating IDS performance at a scale beyond that of currently available public repositories.

This paper proposes a framework that supports a two-stage intrusion analysis pipeline: (i) simulation of physical sensors and IoT devices to generate traffic for anomaly detection, and (ii) intrusion detection with classification to categorize attack types. The eMQTT simulator distinguishes itself from most existing methods, which focus solely on anomaly or intrusion detection, by providing a more comprehensive IoT security solution. Additionally, the dataset generated by eMQTT includes multiple DoS/DDoS scenarios specifically targeting MQTT traffic, offering a valuable benchmark for testing detection algorithms under realistic industrial conditions.

The primary contributions of this work include the development of an MQTT traffic generator and a dataset specifically tailored for IoT intrusion detection research, as well as the demonstration of their effectiveness in addressing the security risks posed by diverse attack types in IoT systems. This research strengthens the foundation for the secure adoption of IoT technologies in critical industrial and societal domains.

The rest of this paper is organized as follows: Section 2 reviews the current state of the art in IoT datasets and existing implementation strategies for intrusion detection. Section 3 introduces the eMQTT simulator framework, detailing its general architecture and core modules. Section 4 provides an in-depth look at the layered software design, covering the data synthesis, mining, and reporting processes. Section 5 presents the experimental results, including dataset validation and classifier performance analysis. Finally, Section 6 concludes the paper with a summary of the work’s contributions and a discussion on potential future research directions.

2. Related Works

2.1. IoT Datasets

Several established datasets have been widely used for intrusion detection research, including the DARPA dataset (1999) [16], the KDD Cup 1999 dataset [17], and CAIDA’s DDoS traces. These datasets are now considered outdated because they do not reflect essential factors such as complexity, heterogeneity, and the unique characteristics of contemporary IoT traffic [18]. Subsequent datasets, such as UNSW-NB15 and CICIDS, introduced more comprehensive features and realistic traffic compositions [19], but were primarily intended for general-purpose intrusion detection system (IDS) evaluation rather than for IoT-specific protocols.

The Bot-IoT dataset advanced the field by modeling IoT botnet activity with over 72 million records and a variety of attack types, including TCP, UDP, and HTTP. However, it does not encompass attacks targeting MQTT, a lightweight messaging protocol extensively used in IoT and Industrial IoT (IIoT) environments [20]. Other initiatives, such as IoTPOT honeypots, capture emerging IoT threats but are limited by the scope of attacker behavior and service coverage [21].

To address MQTT-specific threats, Vaccari et al. [10,22] introduced MQTTset, a dataset that includes DoS, publish-flood, SlowITe, malformed, and brute-force attacks. Similarly, the MQTT-IoT-IDS2020 dataset features MQTT brute-force and scanning attacks. Although these datasets highlight the significance of application-layer data, they are constrained by limited scale, diversity, and extensibility for machine learning applications. Beyond immediate security concerns, enhancing the resilience of MQTT-based IoT systems is essential for the advancement of Industry 4.0 and the reliable operation of critical infrastructure. The secure and uninterrupted functioning of these systems supports applications ranging from automated manufacturing to smart city initiatives, underscoring the urgent need for robust defense mechanisms.

Although earlier benchmarks established a foundation, recent research has focused on developing more sophisticated, protocol-specific datasets. For example, recent studies (e.g., Yadav et al., 2025 [23]) have utilized deep learning models on the MQTT-IoT-IDS2020 dataset to address increasingly complex injection attacks. Nevertheless, many contemporary datasets remain static or lack the capacity to simulate large-scale deployments with customizable hardware-level behaviors. Additionally, recent surveys on MQTT security (2024) emphasize the need for generative frameworks that can adapt to zero-day scenarios by allowing dynamic modification of broker–client interaction parameters. In response to these challenges, the eMQTT framework is introduced as a solution that provides high-fidelity, high-volume synthetic data reflecting the scale and volatility of modern Industrial IoT (IIoT) ecosystems.

Other studies have investigated AI-based techniques, including deep autoencoders for IoT botnets and one-class classification methods [24,25]. These approaches underscore the significance of dataset quality, class balance, and comprehensive packet captures in developing effective IDS models [20]. A persistent challenge is the imbalance between benign and malicious traffic, which reduces detection accuracy in practical deployments.

In summary, current datasets and methodologies either lack adequate MQTT coverage or do not sufficiently model diverse DoS and DDoS attack variants [26]. Specifically, attacks such as CONNECT flooding, delayed authentication, invalid subscriptions, and WILL payload amplification are underrepresented. This deficiency underscores the necessity for scalable MQTT traffic generators and datasets that offer full-packet captures, balanced distributions of attack and normal data, and support for staged anomaly detection and classification in realistic IoT security research [10,27].

Recent contributions, including MQTT-UAD, MQTTEEB-D, and the DoS or DDoS-MQTT-IoT dataset, have substantially increased the availability of labeled MQTT traffic for intrusion detection research. These datasets capture realistic attacks in controlled testbed environments and provide structured data suitable for machine learning evaluation [28,29,30]. However, these datasets are primarily static and derived from predefined experimental conditions, which restricts the ability to dynamically adapt traffic patterns, scale scenarios, or reproduce customized attack behaviors beyond the original setup. In contrast, the proposed eMQTT simulator is designed as an extensible traffic-generation environment, enabling controlled creation of both benign and malicious MQTT flows with adjustable parameters, timing, and scenario configurations. This approach allows researchers to train and benchmark detection models, iteratively design experiments, stress-test algorithms under varying loads, and investigate emerging attack strategies in a reproducible manner. By prioritizing flexibility, configurability, and protocol-level behavior modeling, eMQTT offers a practical experimental platform that facilitates continuous development and evaluation of intrusion detection solutions in evolving IoT environments.

Unlike general-purpose network emulators and attack tools, which focus on infrastructure realism and full-stack network behavior, the eMQTT framework is purpose-built for controlled dataset generation and intrusion detection experimentation. While emulation platforms can replicate complex network environments, they often require extensive configuration, manual labeling of attack phases, and post-processing of raw packet captures to produce structured datasets. In contrast, eMQTT integrates traffic synthesis, protocol-aware attack modeling, structured storage, and automated export within a unified, reproducible pipeline. Additionally, compared to static datasets such as MQTTset and MQTT-IoT-IDS2020, which offer fixed traffic traces with limited scalability or parameter variation, eMQTT supports dynamic adjustment of device density, connection rates, attack intensity, and traffic phase proportions. This parameter-driven approach enables systematic scaling of CONNECT-flooding scenarios and controlled variation of workload characteristics, resulting in large, labeled datasets tailored for comparative intrusion-detection evaluation.

2.2. IoT Implementation for Intrusion Detection

In 1999, Zissman et al. [16] introduced a fuzzy detection method for MQTT, utilizing dynamic rule interpolation. The approach was evaluated with Contiki OS and the COOJA simulator to address resource limitations in IoT devices. Similarly, Sharafaldin et al. [27] proposed a machine learning strategy for detecting denial-of-service (DoS) attacks at the MQTT application layer. These studies highlight MQTT as both a critical enabler of Internet of Things (IoT) systems and a significant attack vector. This perspective differs from research focused solely on generating synthetic traffic using physical devices in real network environments.

In 2018, Meidan et al. [24] introduced deep autoencoders for anomaly detection in IoT traffic. The system was validated on two botnet families, Mirai and BashLite, which are known for TCP/UDP-based flooding and DDoS attacks. This study demonstrated the feasibility of deep learning for IoT security and provided a public dataset that has become a reference for subsequent research. The authors collected traffic data using a typical organizational data-flow infrastructure, with IoT devices connected via Wi-Fi to multiple access points and wired to a central switch linked to a router.

In 2020, Skandari et al. [31] addressed threat detection by classifying malicious flows, including port scans, brute-force attempts, and SYN floods. In a related study, Vaccari et al. [10,22] introduced a slow denial-of-service attack targeting MQTT devices, validated on widely used brokers such as Mosquitto, HiveMQ, and ActiveMQ.

With the advancement of deep learning, studies such as Yadav’s 2025 work have achieved effective attack classification, including DoS, MitM, and intrusion, using fully connected neural networks trained on MQTT-IoT-IDS2020 and other datasets [23]. Additional research has focused on improving MQTT performance under DoS conditions. As brokers like Mosquitto and RabbitMQ are susceptible to degradation from malformed-payload floods or SYN floods, Khan et al. [32] conducted a comprehensive survey of IoT threats across layered architectures, providing taxonomies of machine-learning defenses.

While the eMQTT simulator offers a flexible and configurable environment for generating MQTT traffic, it operates within a controlled experimental context that may not fully capture the unpredictability of large-scale, real-world IoT deployments. Accurately reproducing the behavior of heterogeneous devices, network latency variations, and human interaction patterns remains challenging. Furthermore, the simulator’s attack scenarios are based on known threat models, so emerging or sophisticated zero-day strategies may not be represented. The computational resources available during simulation can also affect traffic realism when scaling to large networks. Consequently, although eMQTT enables reproducible experimentation, complementary validation with real operational data is essential.

Recent research emphasizes lightweight and optimized intrusion detection methods for resource-constrained IoT systems. These include feature selection and Bayesian optimization approaches by Zhang et al. [33] and lightweight machine-learning IDS models by Alomari et al. [34]. Additionally, the survey by Rahman et al. [35] highlights persistent challenges related to dataset quality and reproducibility.

3. Simulator Framework

In this section, we present the architecture of eMQTT, starting with the physical layer of sensors and IoT devices that establish the network topology for intrusion detection. Additionally, some consistency arises from the presentation of the simulations, in accordance with the attack under investigation.

3.1. eMQTT Architecture

Figure 1 presents the eMQTT use-case diagram, summarizing stakeholder interactions and module dependencies. The include relationship indicates that certain functions, such as authentication, always require integration with the device module. The frontend application enables users to create, view, or modify devices. Authentication is the entry point, granting access only to users with valid credentials. Once authenticated, users—classified as standard or root—can create, read, update, and delete resources across modules. The platform simulates interactions with virtual devices, organized as sensors and attackers. Simulated sensors generate typical environmental and electrical measurements, including humidity, temperature, current, voltage, and the Hall effect, to provide realistic data for experimentation.

Figure 1. eMQTT use case diagram showing the core functional modules and user interactions for simulation and system management.

The simulator’s flexibility and scalability facilitate the development of control environments for studying a range of attacker models exhibiting malicious behaviors, such as denial-of-service, brute-force, malformed-data injection, and low-rate attacks, targeting both simulated and real devices. The simulation module orchestrates these components based on user-defined parameters and timeframes, generating synthetic datasets to support comprehensive experimentation and analysis.

This architecture prioritizes system-level design rather than operational usage. Decoupling simulation, attack modeling, data capture, and reporting ensures both scalability and extensibility. The implementation centers on a configurable MQTT platform for traffic generation and experimentation, incorporating user management and interface operations.

The platform’s modular design enables the generation of diverse attack types by implementing attack behaviors as configurable components rather than fixed traffic scripts. New MQTT-specific attack patterns can be integrated by defining parameterized behaviors at the protocol level, such as control-packet manipulation, variation in connection rates, payload modification, and authentication misuse. In contrast to static datasets like MQTTset and MQTT-IoT-IDS2020, which provide predefined and immutable traffic captures, eMQTT supports dynamic configuration of attack intensity, duration, concurrency levels, and broker interaction patterns. This approach enhances scalability by enabling large-volume data generation under controlled conditions and increases diversity by supporting systematic variation of attack parameters. While the present study experimentally evaluates CONNECT-flooding as a baseline scenario, the framework is designed to extend to additional MQTT-layer threats and application-layer attack strategies without requiring core system redesign.

The authentication module serves as the gateway, ensuring secure access to all functionalities. Standard users may perform optional tasks within the device and simulation modules, while root users are responsible for administrative operations. The diagram highlights both mandatory and optional relationships, offering a clear representation of the system’s workflow and access permissions.

In addition to structural modularity, the eMQTT architecture is based on configuration-driven traffic synthesis. Traffic generation is governed by parameterized profiles that specify sensor behavior, communication frequency, payload structure, and attack characteristics, rather than being hardcoded. This design enables the integration of new attack modules as independent components without altering the core system. Each attack behavior is encapsulated as a configurable module capable of manipulating MQTT control packets, connection rates, authentication attempts, or message payload properties. Consequently, the framework supports extensibility by allowing modular extensions that introduce new protocol-aware behaviors.

Traffic variance is achieved through both deterministic and stochastic mechanisms. At the sensor level, configurable distributions determine measurement intervals, payload values, and transmission jitter, resulting in non-uniform communication patterns that more accurately reflect real-world IoT deployments. At the attack level, parameters such as start time, duration, burst intensity, connection concurrency, and packet inter-arrival intervals can be adjusted to simulate various overload conditions. This parameter-driven configuration enables systematic variation of traffic characteristics while maintaining reproducibility.

For example, a simulation profile may be configured with 500 virtual sensors transmitting temperature readings every 2 to 5 s according to a Gaussian distribution, while an attack module initiates a CONNECT-flooding event 10 min into the simulation, lasting 120 s, with a specified connection rate and randomized client identifiers. This high-level configuration demonstrates how diverse operational and adversarial conditions can be synthesized without modifying the underlying architecture. As a result, the framework supports scalable, reproducible, and extensible generation of realistic MQTT traffic suitable for advanced intrusion-detection evaluation.

3.2. Software Architecture

The application is designed for reliability, scalability, and maintainability. Its architecture includes three primary web development layers: frontend, middleware, and backend. Each layer has a defined role and integrates smoothly with the others.

Frontend. The frontend serves as the user interface, allowing interaction with the system through a web portal, as shown in Figure 2. Users can initiate simulations with sensor data and monitor real-time traffic. The interface is optimized for desktops, tablets, and smartphones, streamlining complex tasks and providing notifications and progress updates. For scalability, the frontend operates as an independent module on a virtual server supporting both HTTP and HTTPS. Its modular design allows horizontal scaling by adding nodes as demand grows, ensuring high availability and responsiveness.

Figure 2. Web interface for creating and managing simulations, including sensor selection and execution scheduling.

Middleware. The middleware connects the frontend and backend, translating user requests into system instructions. It handles input, processing, and output by receiving requests, analyzing patterns, and sending structured outputs to the database.

Access points have been proposed to consume web interfaces and complete the functional requirements use case. A web-style architecture was selected, where each feature corresponds to an API access point. This way, by using HTTP-type verbs, we can apply operations to the features.

Backend. Backend modules process and extract traffic information and connect to the database to ensure efficiency, reliability, and robustness. Core components include the eMQTT Data Synthesizer for generating MQTT traffic, the eMQTT Data Analyzer for scanning TCP/IP packets, and the eMQTT Reporter for extracting transaction records. The architecture uses established design patterns for the frontend and an Adapter-Based approach for the backend, supporting reliability, scalability, and maintainability. This design enables a robust, extensible data-generation platform that produces realistic traffic patterns for training and validating intrusion detection systems.

Figure 3 illustrates all application components that support traffic generation, monitoring, and reporting, which form the foundation of the simulation environment.

Figure 3. Architecture of the simulation environment, showing backend components, database server, and modules for data synthesis, mining, and reporting.

The three background processes access the database directly, which serves as the official repository for all project channels. An additional component, referred to as ‘Database jobs,’ is responsible for backend operations but is not classified as software. Within the yellow box, three rectangular elements represent distinct processes. The highlighted processes, eMQTT Dataminer and eMQTT Reporter, were implemented in Python 3. Python was selected for its extensive libraries and strong support for advanced features such as machine learning, data warehousing, and numerical analysis. These capabilities offer the flexibility and efficiency needed for complex data-driven tasks within the system.

Separating the frontend, middleware, and backend layers enables scalable and diverse traffic generation. Decoupling traffic synthesis from packet analysis and reporting allows each component to operate and scale independently. The eMQTT Data Synthesizer generates MQTT traffic, while the DataMiner and Reporter modules manage capture, transformation, and export. This modular approach supports parallel traffic generation without bottlenecks from storage or analysis tasks.

Large-scale simulation is achieved through multi-threaded execution in the synthesis engine, where multiple virtual sensors and attack agents operate concurrently. Thread pools manage publishing events and connection attempts, producing high-volume traffic that simulates realistic broker loads. With traffic generation and data processing separated, synthesis can scale horizontally across distributed nodes, while data mining and reporting services can be provisioned independently to handle increased packet throughput.

The architecture supports scalable and reproducible IoT security experiments by separating traffic generation, packet capture, storage, and export into distinct layers. Captured traffic is stored in an SQL database indexed by simulation parameters, enabling efficient queries and experiment replication without reprocessing large PCAP files. Exporting datasets in HDF5 format improves compression, organization, and I/O performance for large-scale machine learning tasks. This pipeline offers greater scalability, flexibility, and analytical efficiency compared to using only PCAP or CSV outputs, while maintaining packet-level validation.

The architecture also supports distributed deployment in virtualized or cloud environments, allowing synthesis, capture, and storage services to run on separate machines within a controlled network. This distributed approach ensures stable dataset generation under high concurrency and sustained attack conditions. Multi-threading, modular isolation, and independent service scaling enable reproducible generation of large, balanced datasets for evaluating intrusion detection mechanisms in realistic industrial IoT scenarios.

4. eMQTT Layered Software Design

4.1. eMQTT-Datasynth

The eMQTT-Datasynth component converts user configurations into MQTT data packets. The design pattern is based on the well-known MVC (Model-View-Controller) pattern. The main advantage of this architecture is that it keeps business logic separate from the view or event handler. It is often the best design pattern due to its verifiable results (see Figure 4).

Figure 4. MVC-based architecture of the eMQTT-Datasynth component, illustrating the flow from user input to MQTT packet generation through controller, model, view, and thread pool generators.

Model: All configurable attributes of the sensor will be defined in this folder, that is, everything related to its physical properties. For example, the data type definition, lengths, etc. Access to this interface is achieved through encapsulation, as the implementing class is typically defined within a private method.

Controller: All the classes that act as the project’s event handlers are defined in this folder. For convenience, a file named Main is usually included. The Param utility is used to obtain the architecture variables, and Util is used for general or repetitive processing to avoid overloading the central controller.

View: In this folder, a single class will be defined that acts as an output, but not directly facing the user; instead, it interacts with the processes that consume the data from this service. A device is an abstraction of a real-life sensor into a virtual one, composed of model data and controller logic.

4.2. eMQTT-DataMiner

The eMQTT-DataMiner component converts packets generated by the eMQTT-Datasynth component. This is made possible by leveraging Tshark libraries to analyze traffic passing through an entire network interface. The traffic at this level comprises TCP/IP packets moving across the network. Since this information travels between network participants, it lacks persistence. It must be captured by an intermediate system that filters and processes it in real time for final storage in a data repository. This process should serve only as an information converter; it should be scalable to handle parallel internet requests and limited to analyzing only the MQTT protocol (see Figure 5).

Figure 5. Workflow of the eMQTT-DataMiner component, showing MQTT packet capture with Tshark, conversion through the adapter, and storage in a MySQL database.

The component uses the Adapter-Based design pattern and currently converts bit frames into database records. To improve performance, it should execute stored procedures to reduce insertion times and minimize table lock risks during concurrent operations. The process should intercept packets quickly and scale efficiently, with optimization focused on fast INSERT operations. Future enhancements may add new features and design patterns to expand functionality.

4.3. eMQTT-Reporter

The eMQTT-Reporter component converts database records into HDF5 output files. The reporter generates these files according to the input specifications and uses the simulation status along with the start and end dates as parameters. Its operation relies on data extraction and processing; there is no business logic involved, so it can be considered simply an adapter within the system architecture (see Figure 6).

Figure 6. Workflow of the eMQTT-Reporter component, illustrating data extraction from MySQL, queuing, and parallel generation of HDF5 reports through thread pools.

This process must be designed to interact with the database without disrupting other ongoing operations. Note that while the results are being downloaded, new INSERT operations may be performed on the table, which could cause blocking if the data is accessed incorrectly. Most of the logic should reside in the stored procedure to extract data from the database and iterate through the results, adding them to non-blocking queue objects so they can be read by parallel threads that will convert the information from the blocked queue into an HDF5 file.

4.4. Database

The database acts as a central repository, storing information in an organized but unprocessed format. At this stage, data from users, MQTT packets, sensors, simulations, and other sources is collected to support further processing and analysis. Effective database object design is essential for system agility. A well-designed system can handle high volumes of read and write operations without affecting dependent applications. The following section briefly explains and defines the tables used for managing and manipulating information.

The generated dataset provides a clear distribution of normal and malicious traffic to ensure transparency and reproducibility. Normal traffic includes legitimate MQTT publisher and subscriber communications under stable network conditions. Malicious traffic consists of all injected attack scenarios executed during experimentation. The dataset specifies the number of samples per class and their proportional representation, enabling precise assessment of class balance before and after pre-processing. This detailed breakdown supports accurate interpretation of detection results and fair benchmarking of intrusion detection models.

4.5. Decentralized Deployment

The eMQTT platform on IONOS Cloud integrates web, logic, and database servers within a centralized infrastructure. A web cluster, managed by an Nginx or F5 load balancer, distributes requests across multiple nodes to maintain availability and fault tolerance. Each node runs Debian or RHEL with 4 CPU cores, 4 GB RAM, and 20 GB SSD storage. User management for the API eMQTT account is supported, and loopback connections are disabled for security. The logic server, with 8 CPU cores and 12 GB RAM, handles intensive processing and operates under the emqtt user for secure operations. The database server, dedicated to persistent storage, is configured with 8 CPU cores, 8 GB RAM, and 40 GB SSD storage, running under the dbemqtt account. It uses a fixed IP address, disables interactive login for security, and enables loopback for internal communication. Figure 7 shows the interaction of these components within a virtual private cloud, with DNS and routing services providing external internet access. This architecture supports scalability, reliability, and secure resource management for the eMQTT system.

4.6. eMQTT Deployment

The deployment of an application, whether on the server side (backend) or the client side (frontend), is the process of implementing and bringing a software application into operation so that it is available and accessible to end users. This stage is crucial in the software development lifecycle. As previously mentioned, the backend processes are primarily developed in Python 3. This choice was made because Python’s extensive libraries for machine learning, data processing, and numerical analysis are crucial for the complex tasks of synthetic traffic generation and data analysis. This enables efficient development and integration of advanced analytical capabilities into the platform. A brief introduction to application deployment concepts is provided below:

Figure 7. Virtual private cloud (VPC) architecture for the eMQTT system, showing distributed components for simulation, data processing, and reporting, along with DNS and routing services for secure external access.

Figure 7. Virtual private cloud (VPC) architecture for the eMQTT system, showing distributed components for simulation, data processing, and reporting, along with DNS and routing services for secure external access.

4.6.1. Frontend Deployment

Client-side deployment focuses on implementing and running the application’s user interface in a browser or mobile app.

• In the eMQTT project implementation, to configure the FrontEnd module, go to the following link: FrontEnd
• In the eMQTT project implementation, to configure the Session Start module, go to the following link: Session Start
• In the eMQTT project implementation, to configure the Session Stop module, go to the following link: Session Stop.

4.6.2. Backend Deployment

Server-side deployment typically involves configuring and running the application components that run on the server.

• For eMQTT project implementation, to configure the Middleware module, go to the following link: Middleware
• For eMQTT project implementation, to configure the Datasynth module, go to the following link: Datasynth
• For eMQTT project implementation, to configure the DataMiner module, go to the following link: DataMiner
• For eMQTT project implementation, to configure the DataReporter module, go to the following link: DataReporter

Once all services are started and functioning correctly, the next step is to save and configure the services required for eMQTT to operate correctly when the computer’s operating system starts.

4.7. Synthetic Data Generation

The “MQTT Protocol Simulator for the Generation of Standardized Synthetic Data” constitutes the core traffic-generation engine of the eMQTT framework. Unlike general-purpose MQTT workload generators or publicly available simulators that focus mainly on benign publish/subscribe behavior, the eMQTT simulator is protocol-aware and purpose-built for IoT security research. It provides fine-grained, parameterized control over MQTT control flows, session behavior, payload distributions, and attack timing and intensity. This allows the controlled injection of protocol-level adversarial behaviors, enabling the modeling of realistic DoS and anomalous traffic conditions. The simulator operates within a modular architecture that integrates traffic synthesis, structured packet capture, and indexed storage, ensuring reproducibility, scalability, and consistency across experimental runs.

Once all components of the traffic-generation framework are correctly configured and operational, the system proceeds to the data-generation phase. This stage is essential because the synthesized traffic becomes the foundation for subsequent analysis, validation, and intrusion-detection experimentation.

To begin interacting with the eMQTT application, users must first create an account through the registration interface. After successful authentication, the main dashboard is displayed. Before any simulation can be executed, it is necessary to register the virtual sensors that will generate MQTT traffic. Once sensors are configured, the next step is to register simulations, specifying the parameters that define each experiment. For scenarios involving DoS attack emulation, users must follow the configuration steps associated with the DoS traffic module, where attack behavior, intensity, and timing are defined. Each simulation requires two fundamental attributes: a start date and an end date. These timestamps determine the exact interval during which the system remains active and continuously generates synthetic MQTT traffic. Once initiated, the process runs automatically for the entire duration of the configured time window.

To obtain a complete and representative dataset, multiple simulations were executed under varying conditions. These runs were scheduled at different hours of the day and across several days of the week, spanning multiple weeks. This approach ensured variability in operational contexts and generated a robust dataset suitable for machine-learning training, validation, and IoT security experimentation.

This approach captured a wide range of situations and conditions, ensuring the integrity and robustness of the generated data. Two independent datasets were produced, each with 1 million records. The first contains legitimate MQTT traffic representing normal network behavior, while the second simulates Denial-of-Service (DoS) attacks targeting the MQTT protocol, specifically CONNECT flooding.

While this study’s experimental validation focuses on benign traffic and CONNECT-flooding scenarios, the platform is not limited to these cases. Its modular architecture supports additional MQTT-specific attack behaviors, customizable traffic profiles, and parameter-driven simulation configurations. The evaluated scenarios provide a controlled baseline for validation, but the framework can be extended to model other DoS variants and application-layer attack strategies.

The eMQTT framework uses a parameter-driven traffic generation model for precise control over simulation behavior. Users can configure the number of virtual devices, define device categories such as environmental or electrical sensors, set publishing intervals, select QoS levels, and specify payload size and structure. Adversarial behavior can also be configured by setting the number of concurrent attackers, attack timing and duration, connection rate intensity, and the proportions of benign and malicious phases. These parameters shape traffic volume, timing patterns, burst dynamics, and protocol interactions, enabling the creation of statistically varied and operationally realistic datasets.

For example, a simulation might include 500 sensors publishing every two seconds with QoS level 1 during a defined normal operation period, followed by several coordinated attackers generating CONNECT-flooding traffic at a specified request rate for a set duration. This structured parameterization ensures variability in device density, workload intensity, and adversarial conditions, resulting in representative datasets suitable for systematic intrusion detection evaluation.

5. Experimental Results

The experimental evaluation measured classifier performance under varying traffic conditions using synthetic datasets, each containing one million records for large-scale testing. Detection accuracy and robustness were compared between normal MQTT communication and adversarial traffic simulating a CONNECT-flooding attack. The evaluation focused solely on CONNECT-flooding attacks for validation and does not represent the generator’s full range. This controlled setup established a reliable benchmark for assessing the proposed approach in distinguishing legitimate activity from denial-of-service scenarios.

Users registered in the eMQTT application, authenticated through the main interface, and registered all data-logger sensors before starting a simulation. Each simulation was defined by start and end timestamps, setting the active window for automatic MQTT traffic generation. After generation, data were extracted from the MySQL packet storage table and exported to Excel for preprocessing and analysis.

The evaluation used features extracted from generated MQTT traffic to support machine learning analysis. Attributes included connection attempt rate, CONNACK response rate, session duration, publish frequency, packet size statistics, inter-arrival time distributions, QoS level proportions, failed authentication counts, and the ratio of benign to malicious flows within set time windows. Feature extraction was performed at both the packet level and through time-window aggregation to capture protocol behavior and short-term traffic dynamics. This approach supports anomaly detection and supervised classification. The aggregation method, window sizing, and labeling process are clearly defined for reproducibility. The final dataset structure, with feature vectors, class annotations, and temporal segmentation, provides a transparent pipeline from raw packet captures to machine learning–ready data.

To ensure that the simulated attack traffic behaved as expected, we evaluated the datasets against the DoS behavior model described by Haripriya et al. [36]. Their work shows that sustained CONNECT requests saturate the MQTT broker, triggering excessive CONNACK responses and ultimately impairing service availability. The simulated dataset reproduced this pattern, showing the expected rapid increase in CONNECT and CONNACK packets during the attack intervals. This confirmed that the attack simulation accurately captured the dynamics of broker overload events.

To validate the realism of eMQTT-generated traffic, the synthetic datasets underwent a two-step verification. First, statistical properties such as packet size distributions and inter-arrival times were benchmarked against MQTT 3.1.1 protocol characteristics and public traffic captures like MQTTset. Second, behavioral patterns of simulated CONNECT-flooding attacks were validated by monitoring broker response latency and resource exhaustion, ensuring replication of the denial-of-service state seen in physical IoT infrastructure. While this alignment supports robust IDS training, future integration with hardware testbeds will further strengthen empirical validation of the framework’s synthetic outputs.

CONNECT flooding and SlowITe represent different denial-of-service strategies targeting separate broker mechanisms. SlowITe is a low-rate, timing-based attack that mimics legitimate client behavior, making it harder to detect. In contrast, CONNECT flooding is a high-intensity attack that overwhelms broker connection and authentication by sending rapid session requests. Although SlowITe is more stealthy, CONNECT flooding remains highly relevant in industrial IoT due to its ability to quickly disrupt service. This study uses CONNECT flooding as a validated baseline for protocol-aware attack generation. The eMQTT framework, however, also supports low-rate and adaptive attacks, including planned SlowITe-style extensions.

To ensure reproducibility, the experimental environment used Python 3.9 and Scikit-learn v1.0.2 on an Ubuntu 20.04 LTS server with an Intel Core i7-10700K CPU and 32 GB RAM. For classification, the Decision model used a split criterion, no maximum depth, 100 estimators, and maximum feature selection set to the square root of the total features. The eMQTT generator simulated 50 concurrent legitimate sensors and 10 malicious nodes, with a publication frequency of 1 Hz and a keep-alive interval matching the simulation time.

The experimental evaluation confirmed the effectiveness of the eMQTT Traffic Generator and its datasets, as shown in Figure 8. Several machine learning classifiers, including Naive Bayes, Gradient Boosting, Multilayer Perceptron, and Neural Networks, were tested for their ability to distinguish malicious from benign traffic. The gradient boost classifier achieved the highest accuracy in detecting DoS attacks.

Figure 8. Performance comparison of the evaluated machine learning algorithms based on key intrusion-detection metrics. The figure reports Accuracy, Precision, Recall, and F1-Score for each classifier, providing a comprehensive assessment of their ability to correctly identify benign and malicious MQTT traffic. (a) Recall indicates the model’s effectiveness in detecting actual attacks; (b) Accuracy reflects the overall proportion of correctly classified instances; Precision measures how reliably the model identifies malicious traffic without producing false alarms; and (c) F1-Score represents the harmonic mean of Precision and Recall, summarizing detection performance under potential class imbalance.

Furthermore, Figure 8 validates the realism of the generated attack traffic by illustrating the relationship between the number of simulated CONNECT packets and corresponding CONNACK packets over time during a CONNECT-flooding DoS attack, accurately replicating the expected broker overload dynamics. These visualizations affirm the dataset’s efficacy and the generator’s practical utility for developing and evaluating robust intrusion detection systems in IIoT environments.

The behavior depicted in Figure 9 should be interpreted as broker stress rather than a complete service interruption. In MQTT systems, overload does not necessarily result in the immediate cessation of CONNACK responses; instead, it typically manifests as resource saturation and performance degradation. During the CONNECT-flooding phase, the broker continues to generate CONNACK packets, accounting for the visual similarity between the CONNECT and CONNACK curves. The overload condition is evidenced by a sharp increase in connection attempts per second, elevated response latency, greater variance in acknowledgment timing, and increased system resource utilization during the attack interval. These indicators demonstrate that, although protocol-level responses persist, the broker’s session management and authentication subsystems are subject to sustained stress. This analysis clarifies that, in this context, overload refers to degraded operational efficiency during high-intensity connection bursts rather than a total loss of responsiveness.

Figure 9. Simulated CONNECT-flooding DoS attack traffic, showing the correlation between CONNECT and CONNACK packets over time, replicating broker overload dynamics.

Following dataset validation, several machine learning classification algorithms—including Naive Bayes, Gradient Boosting, Multilayer Perceptron, and Neural Networks—were applied to distinguish legitimate MQTT traffic from CONNECT-flooding activity. Among these models, Gradient Boosting achieved the most balanced performance, combining strong accuracy with computational requirements suitable for constrained IoT systems. While Neural Networks and Multilayer Perceptrons demonstrated superior predictive capability, their substantially higher training costs and computational demands render them less practical for deployment on low-power or resource-limited IoT devices. Conversely, Naive Bayes incurred minimal overhead but at the expense of reduced detection accuracy, highlighting the trade-off between lightweight operation and robust intrusion detection performance.

These results underscore the necessity of balancing accuracy with computational efficiency when developing detection mechanisms for MQTT-based systems. The findings further demonstrate the value of synthetic datasets in providing a controlled and reproducible environment for evaluating classifier behavior under both normal and adversarial conditions.

6. Conclusions

This paper presents the design, implementation, and experimental validation of the eMQTT Traffic Generator. This approach addresses the critical need for realistic, balanced, and scalable datasets in IoT intrusion detection research. By employing a modular backend–frontend architecture, eMQTT effectively simulates industrial IoT sensor traffic and diverse denial-of-service (DoS) attack scenarios targeting the MQTT protocol.

A primary contribution of this work is the generation of two high-volume, validated datasets for experimental assessment: one representing legitimate MQTT communication and the other modeling CONNECT-flooding DoS behavior. These datasets were purposefully created to establish a controlled, reproducible validation baseline for the proposed framework. The eMQTT platform is not limited to these two traffic categories; its modular and extensible architecture supports broader traffic modeling, including additional MQTT-specific attack patterns, configurable operational profiles, and parameterized adversarial behaviors. This design enables the generator to be expanded to address a wider range of DoS variants and application-layer threats in future research.

Eliminating human intervention during data generation enhances consistency and reduces bias, while the modular architecture ensures scalability and adaptability for diverse academic and industrial applications. In addition to research applications, the platform offers IT professionals a practical tool for stress-testing MQTT brokers and supporting performance evaluation under controlled conditions. This work strengthens MQTT security by providing a robust foundation for anomaly detection and attack classification. The validated datasets and traffic generator enable reproducible experiments and support the development of more accurate and efficient intrusion detection systems for IoT environments.

Despite the robust performance of the eMQTT framework, certain limitations in the current scope of validation must be acknowledged. Although the platform is architecturally modular and designed to support various threats, such as brute-force or malformed-data injection, the experimental evaluation presented here focuses specifically on CONNECT-flooding denial-of-service (DoS) attacks. This focus enabled a deep, high-volume validation (1 million records) of broker-saturation dynamics; however, other attack classes, while supported by the simulator’s logic, have not yet been empirically tested against the two-stage detection pipeline. Additionally, the current study employs a binary classification setup for initial validation, with expansion into a multi-class, multi-stage detection system planned for future work. Addressing these areas represents critical next steps for advancing the eMQTT framework into a comprehensive, multi-threat evaluation tool for industrial IoT security.

A central strength of the eMQTT framework is its provision of a controlled, reproducible environment specifically designed for structured dataset generation and intrusion detection evaluation, rather than replacing real IoT deployments or network emulation platforms. While Docker-based IoT testbeds and emulation tools such as CORE can generate realistic traffic, they often require complex orchestration, manual attack labeling, and repeated packet tracing to extract usable features. In contrast, eMQTT integrates traffic synthesis, attack parameterization, packet capture, structured storage, and automated dataset export within a unified framework. This integrated pipeline ensures that benign and malicious phases are explicitly defined, consistently labeled, and directly linked to configuration parameters, thereby reducing ambiguity during experimentation. Furthermore, traffic characteristics such as device density, publishing frequency, attack timing, and attack intensity can be systematically varied without redeploying infrastructure or reconfiguring network topologies. This parameter-driven control facilitates scalable dataset production and controlled comparative studies. As a result, eMQTT complements emulation-based approaches by prioritizing experimental repeatability, configurability, and structured data generation tailored to machine learning–based intrusion detection system research.

Moving forward, future work will focus on expanding the eMQTT simulator’s capabilities to model a broader range of MQTT-specific threats, including SlowITe, malformed-message injection, and brute-force attacks against brokers.