IoTEdu Core: Multi-IDS Correlation and Automated Containment of Attacks in Institutional IoT Networks - Ferreira, Emanuel; Ciocca, Matheus; Fideles, Douglas; Barcelos, Tuigg; Quincozes, Silvio; Kreutz, Diego (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
IoTEdu Core is an open-source tool for institutional IoT networks that integrates Suricata, Snort, and Zeek alerts, correlates them by device, and enforces configurable containment through pfSense. Across 240 labeled windows covering ten attack classes and six benign profiles, orchestration increases recall from 0.67 to 0.81, while k-of-n consensus eliminates all false alarms. However, no engine detects SSH brute force, highlighting that consensus cannot address shared blind spots. We also analyze cross-family misclassifications and release the rule set, raw data, and replication scripts.