Attack-to-Defense IoT: A Physical IoT Security Testbed for Labeled Dataset Generation and Machine Learning-Based Attack Detection - Silva, Hebert; Lopes, Mateus; Luisi, João; Demay, Tiago; Moraes, Regina (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg.2026.26912, 2026)
The increasing adoption of Internet of Things (IoT) technologies has significantly expanded the attack surface of Cyber-Physical Systems (CPS), making realistic experimental environments essential for cybersecurity research. This work presents a low-cost and reproducible IoT cybersecurity testbed designed for realistic attack execution, multimodal labeled dataset generation, and Machine Learning (ML)-based intrusion detection. The proposed environment integrates ESP32-based embedded devices, MQTT/TLS communication, AWS cloud services, automated telemetry extraction pipelines, and supervised ML models. The infrastructure supports realistic attack scenarios including MQTT flooding, Sliver Command and Control (C2) beaconing, Denial-of-Service attacks, network scanning, and brute-force attacks against embedded services. The generated datasets combine PCAP-derived network traffic, MQTT telemetry, and sensor-generated events into a unified multimodal representation for intrusion detection experiments. Experimental results indicate that supervised ML algorithms, particularly Random Forest, are effective for detecting volumetric attacks and heterogeneous malicious traffic patterns in constrained IoT environments. The proposed platform contributes a reproducible physical infrastructure for IoT cybersecurity experimentation and establishes a foundation for future research involving Federated Learning (FL), TinyML, and distributed intrusion detection for CPS.