AttackZoo: A Reproducible Testbed for Attack Execution and Network Traffic Dataset Generation - Bitzki, Leonardo; Kreutz, Diego; Bertholdo, Leandro; Kapelinski, Cristhian (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
The recurring generation of network traffic datasets for cybersecurity research is constrained by fragmented experimental workflows, limited reproducibility, and restricted coverage of attack vectors. We present AttackZoo, a reproducible testbed that integrates a containerized repository of 60 attacks categorized according to the MITRE ATT&CK framework and an orchestration layer that centers on a command-line interface (CLI) and automates the full cycle of execution, data collection, and consolidation. The pipeline incorporates traffic capture, log inspection, and feature extraction using multiple tools, producing structured and traceable datasets. In the released campaign, AttackZoo executed all 60 attacks across four execution levels and five repetitions, producing 1200 packet captures and 220.4 GB of derived datasets from 672.1 GB of raw traffic. Overall, the catalog covers 35 MITRE ATT&CK technique/sub-technique entries and 9 tactics, while the orchestration layer reduces the operational overhead of experiments and enables the systematic generation of comparable datasets, with all artifacts openly available.