NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation

• Leonardo Bitzki UFRGS / UNIPAMPA https://orcid.org/0009-0001-8040-7083
• Diego Kreutz UNIPAMPA https://orcid.org/0000-0003-0830-0238
• Tiago Heinrich MPI-INF https://orcid.org/0000-0002-8017-1293
• Leandro Bertholdo UFRGS https://orcid.org/0000-0002-4700-7707
• Silvio Quincozes UNIPAMPA https://orcid.org/0000-0001-6793-4033
• Douglas Fideles UNIPAMPA https://orcid.org/0009-0000-6493-7052
• Angelo Nogueira UNIPAMPA https://orcid.org/0009-0002-7765-3475

DOI: https://doi.org/10.5753/sbcup.2026.23835

Resumo

Cybersecurity research depends on reproducible evidence, traffic traces, logs, and labeled datasets, but public datasets are often static and difficult to re-execute, especially in heterogeneous multi-protocol environments. This paper presents NetSecBed, a container-native, scenario-oriented testbed for controlled generation of network evidence and execution artifacts in IoT, IIoT, and pervasive settings. NetSecBed integrates 60 attack scenarios, 9 target services, and benign traffic generators as single-purpose containers, with plug-and-play extensibility and traceability through declarative specifications. Its pipeline automates parameterized execution, packet capture, log collection, service probing, feature extraction, and dataset consolidation. The result is a repeatable, auditable, and extensible framework that reduces operational bias and supports continuous dataset renewal.

Referências

Akinremi, T. P., Appiah, J. K., Asadi, A. R., Ibitoye, O., Jayathilake, H. M., and Said, H. (2025). Systematic literature review of cybersecurity testbeds for industrial internet of things. In 2025 1st ICSIoT, (SATC), pages 1–7. IEEE.

Alosaimi, M., Rana, O., and Perera, C. (2025). Testbeds and evaluation frameworks for anomaly detection within built environments: A systematic review. ACM Computing Surveys, 57(9):1–36.

Bernieri, G., Etchevés Miciolino, E., Pascucci, F., and Setola, R. (2017). Monitoring system reaction in cyber-physical testbed under cyber-attacks. Computers & Electrical Engineering, 59:86–98.

Cámara, X., Flores, J. L., Arellano, C., Urbieta, A., and Zurutuza, U. (2023). Gotham testbed: a reproducible iot testbed for security experiments and dataset generation. IEEE Transactions on Dependable and Secure Computing, 21(1):186–203.

de Santana, K. G. Q., Schwarz, M., and Wangham, M. S. (2024). Cybersecurity testbeds for iot: A systematic literature review and taxonomy. Journal of Internet Services and Applications, 15(1):450–473.

Dharini, N., Janani, V., and Katiravan, J. (2026). Efficient detection of intrusions in ton-iot dataset using hybrid feature selection approach. Scientific Reports.

Gupta, K., Sahoo, S., Panigrahi, B. K., Blaabjerg, F., and Popovski, P. (2021). On the assessment of cyber risks and attack surfaces in a real-time co-simulation cybersecurity testbed for inverter-based microgrids. Energies, 14(16).

Jr., N. P., Andrade, A., Mello, E., Wangham, M., and Nogueira, M. (2021). Um ambiente de experimentação em cibersegurança para internet das coisas. In Anais do VI Workshop do testbed FIBRE, pages 68–79, Porto Alegre, RS, Brasil. SBC.

Khan, M., Rehman, O., Rahman, I. M., and Ali, S. (2020). Lightweight testbed for cybersecurity experiments in scada-based systems. In 2020 International Conference on Computing and Information Technology (ICCIT-1441), pages 1–5. IEEE.

Pospisil, O., Fujdiak, R., Mikhaylov, K., Ruotsalainen, H., and Misurec, J. (2021). Testbed for lorawan security: Design and validation through man-in-the-middle attacks study. Applied Sciences, 11(16).

Ravikumar, G., Hyder, B., and Govindarasu, M. (2020). Next-generation cps testbed-based grid exercise - synthetic grid, attack, and defense modeling. pages 92–98.

Roy, S., Panaousis, E., Noakes, C., Laszka, A., Panda, S., and Loukas, G. (2023). Sok: The mitre att&ck framework in research and practice. arXiv preprint arXiv:2304.07411.

Santana, K., Meyer, B., Gemmer, D., Schwarz, M., and Wangham, M. (2025). Estendendo o mentored testbed para a execução de experimentos de cibersegurança multi-cluster e iot. In Anais do XLIII SBRC, pages 868–881, Porto Alegre, RS, Brasil. SBC.

Shafi, M., Lashkari, A. H., and Roudsari, A. H. (2025). Ntlflowlyzer: Towards generating an intrusion detection dataset and intruders behavior profiling through network and transport layers traffic analysis and pattern extraction. Computers & Security, 148:104160.

Siboni, S., Sachidananda, V., Meidan, Y., Bohadana, M., Mathov, Y., Bhairav, S., Shabtai, A., and Elovici, Y. (2019). Security testbed for internet-of-things devices. IEEE Transactions on Reliability, 68(1):23–44.

Wlazlo, P., Sahu, A., Mao, Z., Huang, H., Goulart, A., Davis, K., and Zonouz, S. (2021). Man-in-the-middle attacks and defence in a power system cyber-physical testbed. IET Cyber-Physical Systems: Theory & Applications, 6(3):164–177.

Yang, C. C. S., Keat, L. C., Phing, N. Y., and Chi, P. G. (2025). Simulation analysis of syn flood and http flood attacks on cloud infrastructure integrity. International Journal of Research and Innovation in Social Science (IJRISS), 9(10).