From Traffic Records to a Model Comparison

For CMU’s System Toolchains course, I worked on an end-to-end pipeline for classifying IoT traffic across six normal and attack classes. The system processed 20 million MQTT records through Google Cloud Storage, Spark, and a Dockerized PostgreSQL database, bringing ingestion, feature engineering, and model evaluation into one workflow.

Spark transformed protocol flags and numerical fields into 47-dimensional features. Parquet checkpoints separated expensive data preparation from repeated training, and a streaming loader made the same features available to PyTorch models.

Choosing the Model from the Evidence

Model Test Accuracy
Logistic Regression 74.97%
Shallow MLP 75.40%
Deep MLP 75.40%
Random Forest 78.52%

A 30-tree random forest with depth 7 performed best on the MQTTset test split, exceeding both MLPs by 3.12 percentage points. Added neural-network depth did not improve this result. The project combined a distributed data workflow on GCP Dataproc with a direct comparison of model choices on the same engineered features.