TCP Connections Research Articles

Explore Utilizing Network Traffic Distribution to Detect Stepping-Stone Intrusion

In the past three decades, stepping-stone intrusion has become a professional and primary way used by intruders to launch their attacks since they can be protected behind a long TCP connection chain. Many different algorithms have been proposed to detect stepping-stone intrusion since 1995. But most algorithms cannot resist intruders’ session manipulation. In this paper, we propose a novel approach using the distribution of round-trip time (RTT) of network traffic to detect stepping-stone intrusion. This approach can resist intruders’ chaff-perturbation since the round-trip time of network packets can fairly be affected by chaffed packets. The ratio between the standard deviation of the RTTs between Send and Echo packets and the standard deviation of the RTTs between Send and Ack packets can be used to predict if a stepping-stone intrusion exists. The closer to 0 the ratio, the more suspicious a stepping-stone intrusion.

ProDetect: A Proactive Detection Approach of the TCP SYN Flooding Attack in the SDN Controller

The TCP SYN flooding attack or assault is one of the most prominent methods for the controller layer and the target server exhaustion in software-defined networking (SDN). The switches in the data layer or plane are forced to transfer an enormous amount of illicit SYN requests that the adversary creates to the controller because there are no forwarding rules. This extensive forwarding strains the computing capacity of both the data layer and the control layer and clogs the transmission route connecting them. We suggest a dynamic threshold-based countermeasure in this research, named ProDetect, to proactively cater to the SYN flooding attack in the SDN environment. We have fully implemented ProDetect as a security extension on the SDN controller for verifying inbound TCP connections. For SYN requests those that pass through ProDetect's validation test, the controller installs data forwarding policies for them and other malicious hosts sending forged requests are blocked. Therefore, these hosts are barred from sending any new TCP requests to the switches present inside the data layer. We have also employed a strategy to cope with forged MAC addresses in this work. When compared with the existing approaches, the evaluation of performance conducted by the simulation data reveals that ProDetect demonstrates low side effects for legitimate TCP requests and increases the total response time through an onset of SYN flooding operation.

A Regeneration Model for Mitigation Against Attacks on HTTP Servers for Mobile Wireless Networks

The widespread expansion of the internet has fueled a global surge in the utilization of various online transactions, with a significant portion of such services operating on mobile web platforms. Simultaneously, the deployment of innovative Mobile Ad Hoc Network (MANET) technologies and mobile applications has grown as solutions for diverse tasks. Unfortunately, this progress has attracted the attention of hackers, who continually devise new strategies to exploit the vulnerabilities inherent in mobile networks. This study aims to address the escalating challenges posed by cyber threats in the era of widespread internet expansion, particularly focusing on securing mobile web platforms against sophisticated attacks such as Structured Query Language Injection (SQLi) for web-based database solutions and Denial of Service (DoS/DDoS) for various applications. In response to the identified vulnerabilities, this paper proposes an HTTP regeneration (HReg) model that not only detects various cyber-attacks but also ensures the uninterrupted provision of critical services during such incidents. The model introduces an innovative regeneration algorithm capable of scanning both the connection channel and web application to detect attacks, creating survivable connections within the underlying TCP engine to replace compromised ones during an ongoing attack. In simulated environments using OMNeT++, where the server is subjected to attacks, the experimental results demonstrate the efficacy of the model. The response and performance metrics, including throughput (73%), delivery ratio (68.8%), delay (3s), and network load, showcase the model's ability to detect and neutralize attacks. A comparison with state-of-the-art approaches highlights the superior performance of the regeneration model, attributed to its additional survivability layer. While the regeneration model proves robust in simulated environments, its real-world application may encounter limitations. Future research should explore these limitations to enhance the practical applicability of the proposed model. The proposed HReg model's resilient performance under attack conditions ensures the survivability of web-based applications. This innovative approach offers practical implications for securing mobile web platforms, providing continuous delivery of critical services even in the face of persistent and evolving cyber threats. This research addresses a significant gap in existing efforts by not only focusing on attack detection but also emphasizing the development of a survivable TCP connection for HTTP servers during attacks. The introduced regeneration model stands out for its unique ability to maintain service continuity, showcasing originality in the approach to cybersecurity in the context of web-based applications.

Practicable live container migrations in high performance computing clouds: Diskless, iterative, and connection-persistent

Checkpoint/Restore techniques had been thoroughly used by the High Performance Computing (HPC) community in the context of failure recovery. Given the current trend in HPC to use containerization to obtain fast, customized, portable, flexible, and reproducible deployments of their workloads, as well as efficient and reliable sharing and management of HPC Cloud infrastructures, there is a need to integrate Checkpoint/Restore with containerization in such a way that the freeze time of the application is minimal and live migrations are practicable. Whereas current Checkpoint/Restore tools (such as CRIU) support several options to accomplish this, most of them are rarely exploited in HPC Clouds and, consequently, their potential impact on the performance is barely known. Therefore, this paper explores the use of CRIU’s advanced features to implement diskless, iterative (pre-copy and post-copy) migrations of containers with external network namespaces and established TCP connections, so that memory-intensive and connection-persistent HPC applications can live-migrate. Our extensive experiments to characterize the performance impact of those features demonstrate that properly-configured live migrations incur low application downtime and memory/disk usage and are indeed feasible in containerized HPC Clouds.

Countering DDoS threats: leveraging ensemble methods for detection and mitigation

Cloud computing is the modern concept of distributing numerous services through the Internet, such as web applications, databases, and programmers that operate on several servers. As Cloud computing technologies evolve, increasing susceptibility to attack may result from service outages during data storage and transmission. The most common sort of assault against Cloud settings is distributed denial-of-service (DDoS). Several approaches for detecting and mitigating these attacks have been offered, however they are ineffective. In this research, we propose a method for detecting and mitigating DDoS attacks in their early phases, considering top-layer advances at the application layer and the TCP handshake mechanism. This study employs a variety of ensemble-based machine learning approaches to classify incoming data as legitimate or malicious to respond to DDoS attacks at the application layer. Furthermore, the double TCP connection concept is used to prevent DDoS. Experiments show that the stacked voting system detects DDOS attacks with the best F-score of 99.9%.

Evaluating the Performance of 5G NR in Indoor Environments: An Experimental Study

The 5G wireless standard has emerged as a trans-formative technology with the potential to revolutionize various industries by providing enhanced connectivity and communication capabilities. This advanced standard offers a diverse range of applications, including Ultra-Reliable Low-Latency Communication (URLLC), Enhanced Mobile Broadband (eMBB), and Massive Machine Type Communication (mMTC). In this Scientific research paper, we present a comprehensive analysis of the performance and capabilities of a deployed indoor 5G network in a controlled laboratory environment. The experimental setup comprises an Amarisoft Callbox, serving as the 5G core, along with a Remote Radio Head (RRH) and user equipment (UEs). Our primary objective is to assess the network's performance by evaluating the downlink, uplink, and joint downlink/uplink transmissions for TCP and UDP protocols between the gNodeB and user equipment (UE). To achieve this, we carefully examine key performance metrics such as latency, power consumption, CPU utilization, and signal quality. Through various configurations that involve MIMO 2 technology and a 30 kHz sub-carrier spacing, we investigate the impact of different NR Bandwidth settings. By establishing TCP and UDP connections for both uplink and downlink scenarios, we meticulously measure and scrutinize the system's performance, thereby providing valuable insights into its efficiency and suitability for diverse application requirements.

Surveillance Camera Using Wi-Fi Connection

This research paper aims to design an energy-efficient surveillance camera utilizing the ESP32-CAM module, incorporating Wi-Fi connectivity, and using 3D printed custom case made from ABS plastic. The central goal is to determine the most effective video streaming protocol for transmitting real-time data to a web-based interface that manages the camera. The camera prototype is developed through a technical feasibility study and prototype construction methods, with a primary focus on assessing power consumption across various protocols including HTTP, RTP, RTSP, and WebSocket. The findings indicate that WebSocket emerges as one of the most optimal and power-efficient protocols for streaming video from the ESP32-CAM web server to a client device. This superiority arises from WebSocket's browser-based approach, enabling full-duplex communication through a single TCP connection, thereby facilitating real-time interaction between the client and server.

Novel MITM attack scheme based on built-in negotiation for blockchain-based digital twins

As smart contracts, represented by Solidity, become deeply integrated into the manufacturing industry, blockchain-based Digital Twins (DT) has gained momentum in recent years. Most of the blockchain infrastructures in widespread use today are based on the Proof-of-Work (PoW) mechanism, and the process of creating blocks is known as “mining”. Mining becomes increasingly difficult as the blockchain grows in size and the number of on-chain business systems increases. To lower the threshold of participation in the mining process, “mining pools” have been created. Miners can cooperate and share the mining rewards according to the hashrate they contributed to the pool. Stratum is the most widely used communication protocol between miners and mining pools. Its security is essential for the participants. In this paper, we propose two novel Man-In-The-Middle (MITM) attack schemes against Stratum, which allow attackers to steal miners' hashrate to any mining pool using hijacked TCP connections. Compared with existing attacks, our work is more secretive, more suitable for the real-world environment, and more harmful. The Proof-of-Concept (PoC) shows that our schemes work perfectly on most mining softwares and pools. Furthermore, we present a lightweight AI-driven approach based on protocol-level feature analysis to detect Stratum MITM for blockchain-based DTs. Its detection model consists of three layers: feature extraction layer, vectorization layer, and detection layer. Experiments prove that our detection approach can effectively detect Stratum MITM traffic with 98% accuracy. Our work alerts the communities and provides possible mitigation against these more hidden and profitable attack schemes.

Remote access trojan traffic early detection method based on Markov matrices and deep learning

Remote Access Trojan (RAT) allows the attacker to gain remote control of an infected system and steal data from it. Due to over-reliance on expert experience and statistical features, most feature-based RAT detection methods perform inefficiently and can only achieve high accuracy with network traffic collected over a long period of time. Byte-based RAT detection methods often use sequence truncation to process network traffic to meet the uniform-sized input requirements of convolutional neural networks (CNNs). However, the sequence truncation brings a negative impact on detection accuracy for some information loss. Towards effective and efficient RAT detection, we define the early stage from the damage degree caused on victim hosts and propose a new RAT traffic early detection method based on Markov matrices and deep learning (RATMD). In RATMD, the byte sequence of the TCP payloads of the TCP service packets collected in the early stage is represented by a byte transition probability matrix with a fixed size of 256 × 256, and the generated matrices are used to construct a detection model using a CNN architecture. Experiments are conducted on the network traffic of 58 benign applications and 61 RATs. Employing only the byte sequences derived from the TCP payloads of the TCP service packets in the traffic between the first TCP connection established by the application client and the third TCP service packet sent by the application server, RATMD achieves a detection accuracy of 95.5%.

FlexCP: A Scalable Multipath TCP Proxy for Cellular Networks

Research has shown that Multipath TCP (MPTCP) improves the quality of a TCP connection by exploiting multiple paths, but its adoption in the wide area network is still fledgling. While MPTCP-TCP proxying is often employed as a practical solution, the performance of a split-connection proxy is suboptimal – it wastes CPU cycles on content relaying between two connections while it does not efficiently leverage multiple CPU cores in packet processing. We present FlexCP, a high-performance MPTCP-TCP proxy based on the following properties. First, FlexCP operates by translating the two protocols on a packet level. This approach not only avoids the overhead of flow reassembly and memory copying, but it greatly simplifies the implementation as the proxy stays away from reliable data transfer, socket buffer management, and per-hop congestion/flow control. Second, FlexCP maintains connection-to-core affinity for multiple subflows of the same MPTCP connection and its corresponding TCP connection by leveraging SmartNIC. This enables a lock-free implementation for packet processing, which significantly improves the performance. Our evaluation demonstrates that FlexCP achieves 281 Gbps of connection proxying on a single machine, outperforming existing proxies by up to 6.3× in terms of throughput while it incurs little extra latency over direct TCP/MPTCP connections.

A Novel Approach for Detection of DoS / DDoS Attack in Network Environment using Ensemble Machine Learning Model

One of the most serious threat to network security is Denial of service (DOS) attacks. Internet and computer networks are now important parts of our businesses and daily lives. Malicious actions have become more common as our reliance on computers and communication networks has grown. Network threats are a big problem in the way people communicate today. To make sure that the networks work well and that users' information is safe, the network data must be watched and analysed to find malicious activities and attacks. Flooding may be the simplest DDoS assault. Computer networks and services are vulnerable to DoS and DDoS attacks. These assaults flood target systems with malicious traffic, making them unreachable to genuine users. The work aims to enhance the resilience of network infrastructures against these attacks and ensure uninterrupted service delivery. This research develops and evaluates enhanced DoS/DDoS detection methods. DoS attacks usually stop or slow down legal computer or network use. Denial-of-service (DoS) attacks prevent genuine users from accessing and using information systems and resources. The OSI model's layers make up the computer network. Different types of DDoS strikes target different layers. The Network Layer can be broken by using ICMP Floods or Smurf Attacks. The Transport layer can be attacked using UDP Floods, TCP Connection Exhaustion, and SYN Floods. HTTP-encrypted attacks can be used to get through to the application layer. DoS/DDoS attacks are malicious attacks. Protect network data from harm. Computer network services are increasingly threatened by DoS/DDoS attacks. Machine learning may detect prior DoS/DDoS attacks. DoS/DDoS attacks proliferate online and via social media. Network security is IT's top priority. DoS and DDoS assaults include ICMP, UDP, and the more prevalent TCP flood attacks. These strikes must be identified and stopped immediately. In this work, a stacking ensemble method is suggested for detecting DoS/DDoS attacks so that our networked data doesn't get any worse. This paper used a method called "Ensemble of classifiers," in which each class uses a different way to learn. In proposed methodology Experiment#1 , I used the Home Wifi Network Traffic Collected and generated own Dataset named it as MywifiNetwork.csv, whereas in proposed methodology Experiment#2, I used the kaggle repository “NSL-KDD benchmark dataset” to perform experiments in order to find detection accuracy of dos attack detection using python language in jupyter notebook. The system detects attack-type or legitimate-type of network traffic during detection ML classification methods are used to compare how well the suggested system works. The results show that when the ensembled stacking learning model is used, 99% of the time it is able to find the problem. In proposed methodology two Experiments are implemented for comparing detection accuracy with the existing techniques. Compared to other measuring methods, we get a big step forward in finding attacks. So, our model gives a lot of faith in securing these networks. This paper will analyse the behaviour of network traffics.

Hybrid VGG19 and 2D-CNN for intrusion detection in the FOG-cloud environment

Fog computing (FC) extends cloud technology by providing services, storage, and network interaction between data centers and end devices. By putting storage and processing closer to the network edge, fog computing may improve IDS effectiveness and efficiency. We develop a cloud-fog intrusion detection system (CFIDS) that employs cloud and fog resources to identify threats in the current research. However, the attack affects data packets from Fog layer nodes. The majority of intrusive cyber-attacks are close variants of previously identified cyber attacks with duplicate data and attributes. In addition, the data packet must be analyzed to determine the intrusion. SYN packets, used to initiate TCP connections, flood a victim's network in a syn threat. To mitigate the impact of syn attacks in a FC environment, it is essential to implement the necessary security measures. Deep learning-based IDS are suitable for protecting fog computing layers from attacks and addressing current issues. The authors of this paper have put forth a new hybrid architecture for DL intrusion detection in fog computing, which combines the use of DL models. Due to the large dimensionality of network data, Radial basis function-based support vector regression (RBFSVR)is initially used to minimize the dimensionality of the data and reduce the training time. Then, on the cloud server, the integrated VGG19 and 2DCNN are utilized to complete the dataset's training and transfer it to the fog layer, where data transmission is observed and threats are recognized. Experiments with the UNSW-NB15, CICIDS2017, and CICIDS2018 datasets demonstrate that the techniques presented in this paper outperforms other comparable techniques in terms of detection rate, F-score, precision, recall, FAR, and accuracy, thereby solving the problem of intrusion detection. In addition, by analyzing irregular patterns of network traffic, flow duration isutilized to avoid harmful attacks in a fog computing environment.

Analysis of Behavioral Characteristics of Multiple Blackhole Attacks with TCP and UDP Connections in Mobile ADHOC Networks based on Machine Learning Algorithms

In Mobile Adhoc Networks (MANET’s), a suit of nodes which are under mobility work together to transmit data packets in a multiple-hop manner without relying on any fixed or centralized infrastructure. A significant obstacle in managing these networks is identifying malicious nodes, or "black holes". To detect black holes, we proposed a method involves broadcasting a Cseq to the neighboring nodes and awaiting the node's response is utilized. This Network is simulated with 25 number of nodes connected with TCP connection and observed the different behavioural characteristics of nodes. Then the connections are changed to UDP and observed the characteristics. Then characteristics are analyzed with different machine learning algorithms. The network is simulated in NS2 environment.

Simulation of SDN in mininet and detection of DDoS attack using machine learning

Most contemporary businesses are embracing software defined networking (SDN), a developing architecture that enables an aerial-like perspective of the entire network. SDN operates by virtualizing the network and provides advantages including improved performance, visibility, speed, and scalability. SDN attempts to divide the network control plane from the forwarding plane. The control plane, which includes one or more controllers and incorporates complete intelligence, is thought of as the brain of the SDN. However, SDN has challenges with controller vulnerability, flexibility, and hardware security. But distributed denial of service (DDoS) assaults constitutes a serious threat to the SDN. Transmission control protocol-synchronized (TCP-SYN) floods, a common cyberattack that can harm SDNs, can deplete network resources by opening an excessive number of illegitimate TCP connections. In this research, we provide an OpenFlow port statistic-based architecture for machine learning (ML) enabled TCP-SYN flood detection. This research showed that ML models like support vector machine (SVM), Navie Bayes, and multi-layered perceptron can distinguish between regular traffic and SYN flood traffic and can mitigate the impacts of the attacking node on the network. Results showed that the multilayered perceptron can classify the traffic with highest accuracy of 99.75% for the simulation dataset.

ConPoolUBF: Connection pooling and updatable Bloom filter based SYN flood defense in programmable data planes

SYN flood attack is one of the common ways in which attackers take the advantage of TCP’s three-way handshake connection establishment to overwhelm target systems. With the emergence of programmable networks, many promising security functions have been implemented at the network layer. SYN authentication and cookie-based SYN proxy are two significant approaches recommended on programmable switches against SYN flood attacks. However, while the implementation of a cookie-based SYN proxy causes additional delays and packet drops, the SYN authentication approach increases the number of packets required to establish a TCP connection. In this study, two novel functions are implemented on programmable switches using the P4 language, and a new security solution against SYN flood attacks is proposed by combining both functions. The first function is the high-accuracy updatable Bloom filters implemented to track the state of network flows for TCP connection establishment. As the proposed data structure uses a salted input, it is more resistant to target-set coverage attacks. The second is the connection pooling function on programmable switches for requests to the backend servers. In this regard, the TCP three-way handshake is offloaded from the target systems to network switches. Upon the verification of a connection request, dynamic resource allocation is carried out from the connection pool on the P4 switch, enabling the client to connect to the server seamlessly and transparently without the need for additional packets. We implement these functions and demonstrate their feasibility as an effective defense against SYN flood.

Design and Suitability Analysis of FPGA-Based TCP/IP Offload Module for Control Systems of FBRs

Transmission Control Protocol/Internet Protocol (TCP/IP) offload modules play a crucial role in India’s first commercial fast breeder reactor (PFBR) distributed digital control system architecture by providing networking capabilities to the real-time control systems used in safety-critical and safety-related applications of the PFBR. These modules enable operators to remotely control various mechanisms, facilities, and process loops via real-time control systems from the main control room display stations. The malfunctioning of these modules may hamper the overall plant’s availability; hence to improve further upon safety, security, reliability, and performance, these modules have been indigenously developed for upcoming fast breeder reactors in India. This paper proposes methods to justify the suitability of these communication modules as per the D-25 design guidelines issued by the Atomic Energy Regulatory Board of India. The design and testing aspects are covered, including an approach toward hardware descriptive language-based design and testing with respect to the IEEE standard and the TCP/IP protocol specifications. Module design validation based on ethernet frame transactions is detailed in this paper. The test platform design, which includes the diagnostics software design for CPUs designed with these TCP offload modules, and the design of a graphical user interface to detect and record TCP connection anomalies are detailed. The network interface response to postulated events of TCP packet corruption, packet drop, packet delay, out-of-order packets, duplicate packets, and heavy traffic is characterized.

A new dynamic security defense system based on TCP_REPAIR and deep learning

Honeypot is an active defense mechanism, which attracts attackers to interact with virtual resources in the honeypot mainly by simulating real working scenarios and deploying decoy targets, so as to prevent real resources from being damaged and collect attackers’ attack processes and analyze potential system vulnerabilities to proactively respond to similar attacks. Because of the existing honeypot system has defects such as the inability to deploy specific honeypots to induce attacks based on complex attacks, the inability to select the best honeypot for dynamic response based on honeypot deployment and maintenance costs during attack interactions, and insufficient ability to identify variants of known attack methods. Although hybrid honeypots can solve some of these problems by deploying low-interaction honeypots and high-interaction honeypots, they cannot really be applied to real production scenarios because of their slow TCP connection switching speed and inability to efficiently identify encrypted malicious traffic. In this paper, we propose a new dynamic security defense system based on the combination of TCP_REPAIR-based dynamic honeypot selection architecture and a deep learning-based intelligent firewall. The system accurately distributes encrypted or non-encrypted attack traffic and its variants through the intelligent firewall. The normal traffic is sent to the actual system, and the marked malicious traffic dynamically selects honeypots to respond according to the attack process.The experimental result indicated that the system can select honeypots for targeted responses according to the actual network situation quickly and dynamically and covertly, effectively improving the utilization rate of honeypot clusters as well as the ability to decoy.

Robotic Solution for the Automation of E-waste Recycling

This paper focuses on the issue of e-waste and the use of a 6 Axis Robotic manipulator to build and test an industrial robotic system to detect components of commonly disposed of E-waste, then disassemble and segregate the main components for proper disposal and recycling using OpenCV image capture, TCP connections between OpenCV and ESPON, Arduino integration for Servo control and 3D Printed fixtures for disassembly.

DataPlane‐ML: An integrated attack detection and mitigation solution for software defined networks

SummarySoftware defined network (SDN) is a paradigm that emphasizes the separation of the control plane from the data plane, offering advantages such as flexibility and programmability. However, from a security perspective, SDN also introduces new vulnerabilities due to the communication required between these planes. SYN Flood attacks are typical distributed denial‐of‐service (DDoS) attacks that especially challenge network administrators since they produce a large volume of semi‐open TCP connections to a target, compromising its availability. Most of the current solutions to detect and mitigate these attacks are designed to operate at the control plane, imposing an additional overhead on controller functions. Moreover, traffic‐blocking mechanisms, a widely used alternative to protect network resources, have the drawback of restricting legitimate traffic. This work proposes DataPlane‐ML, an integrated solution to detect and mitigate DDoS attacks on SDN, acting directly in the data plane. DataPlane‐ML uses machine learning techniques for attack detection and a mitigation solution based on the node's reputation to avoid blocking legitimate traffic during an attack. Experimental results show that DataPlane‐ML is faster than statistical‐based solutions for attack detection while presenting better accuracy. Moreover, the DataPlane‐ML mitigation solution can preserve more than of legitimate traffic during an attack.

РЕАЛИЗАЦИЯ MQTT КЛИЕНТА НА БАЗЕ ОДНОКРИСТАЛЬНОГО МИКРОКОНТРОЛЛЕРА ДЛЯ ЗАДАЧ УДАЛЕННОГО УПРАВЛЕНИЯ ОБОРУДОВАНИЕМ

The article describes a device that transmits data and processes commands over the MQTTprotocol on the Internet. A small batch was made to assess the performance in real practice. Thesoftware for the microcontroller is written in C using a real-time operating system (RTOS), whichallows you to streamline software development through pseudo-parallel code execution, task synchronizationmechanisms (semaphores, mutexes), and a queue mechanism. The paper presents anexample of an algorithm for the interaction of FreeRTOS tasks: the tasks of waiting for a commandfrom the server, the tasks of measuring temperature, the main thread that sends a messageto the server in response to the appearance of a line in the message queue. The core of the MQTTclient being developed is the STM32 microcontroller and the GSM/GPRS SIM800 module. A largenumber of interfaces are displayed on the device, which allows you to connect a wide variety ofperipherals (temperature, humidity, pressure sensors, servos, etc.). The device is able to independentlyrestore the connection to the network in case of its interruption. The proprietary implementationof the MQTT protocol version 3.1 QoS 0 is used in the software of the control microcontroller.MQTT messages are transmitted as part of a TCP connection established by means of a GSM module. The control microcontroller communicates with the GSM module via AT commands.The possibility of two-way real-time messaging is implemented, which allows using the developedmicroprocessor system both in the mode of an autonomous control device and in the interactivemode of executing commands received wirelessly and sending the execution statuses of thesecommands. The main feature of the MQTT client is the ability to remotely update the microcontrollersoftware (OTA), implemented using an auxiliary microcontroller and a flash memory chip.The developed MQTT client is intended to be used as the basis of microprocessor systems - clientsof the Internet of Things.