Abstract: With the wide application of Internet of things technology, the industrial Internet of things system suffers from increasing network security threats, and information security becomes a major challenge in its development. The MQTT (Message Queuing Telemetry Transport) protocol is the mainstream protocol for Internet of things communication. The research on communication security of Internet of things based on the protocol is a hot topic at present. In order to ensure the communication security of restricted devices in the Internet of things, this paper focuses on the abnormal detection of MQTT traffic. Traditional traffic identification technology such as deep packet inspection cant effectively identify abnormal traffic conforming to packet format, and abnormal traffic identification technology based on machine learning theory shows very good effect. For this, a MQTT abnormal traffic detection method based on random forest algorithm is proposed, which achieves an overall accuracy of more than 90% and gets better recognition effect than other common classification models.

Key words: abnormal traffic detection, random forests, MQTT, flow features