eMQTT Traffic Generator for IoT Intrusion Detection Systems

The development of effective Intrusion Detection Systems (IDS) for Internet of Things (IoT) environments is constrained by the absence of realistic, large-scale datasets, particularly for the Message Queuing Telemetry Transport (MQTT) protocol, which is prevalent in industrial IoT. Existing datasets are frequently limited in scope, imbalanced, or do not capture MQTT-specific attack patterns, thereby impeding the training of accurate machine learning models. To address this gap, the extensible Message Queuing Telemetry Transport (eMQTT) Traffic Generator is introduced as a modular platform capable of simulating both legitimate MQTT communication and targeted denial-of-service (DoS) attacks. The framework features a scalable and reproducible architecture that incorporates protocol-aware attack modeling, automated traffic labeling, and direct export of datasets suitable for machine learning applications. The system produces standardized, configurable, repeatable, and publicly accessible datasets, thereby facilitating reproducible research and scalable experimentation. Experimental validation demonstrates that the simulated traffic aligns with established DoS behavior models. Two high-volume datasets were generated: one representing normal MQTT traffic and another emulating CONNECT-flooding attacks. Machine learning classifiers trained on these datasets exhibited strong performance, with gradient boosting models achieving over 95% accuracy in distinguishing benign from malicious traffic. This work offers a practical solution to the scarcity of datasets in IoT security research. By providing a controlled, extensible, and reproducible traffic-generation platform alongside validated datasets, eMQTT enables systematic experimentation, supports the advancement of IDS solutions, and enhances MQTT security for critical IoT infrastructures.