NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation
Organizations: Federal University of Rio Grande do Sul (UFRGS) · AI Horizon Labs and PPGES – Federal University of Pampa (UNIPAMPA) · Max Planck Institute for Informatics (MPI-INF)
Abstract
Cybersecurity research increasingly depends on reproducible evidence, such as traffic traces, logs, and labeled datasets, yet most public datasets remain static and offer limited support for controlled re-execution and traceability, especially in heterogeneous multi-protocol environments. This paper presents NetSecBed, a container-native, scenario-oriented testbed for reproducible generation of network traffic evidence and execution artifacts under controlled conditions, particularly suitable for IoT, IIoT, and pervasive multi-protocol environments. The framework integrates 60 attack scenarios, 9 target services, and benign traffic generators as single-purpose containers, enabling plug-and-play extensibility and traceability through declarative specifications. Its pipeline automates parametrized execution, packet capture, log collection, service probing, feature extraction, and dataset consolidation. The main contribution is a repeatable, auditable, and extensible framework for cybersecurity experimentation that reduces operational bias and supports continuous dataset generation.
Figures & tables
| Testbed | Scientific Contributions | Scalability | Protocols | #Atk | Target Services | Main Limitations |
|---|---|---|---|---|---|---|
| Gotham | Reproducible IoT testbed; multi-protocol support; real dataset generation | 140 nodes / machine | MQTT, CoAP, RTSP | 18–25 | MQTT broker, CoAP, RTSP | Restricted service scope; limited device diversity; no MITRE ATT&CK mapping |
| RESLab | Security experimentation and dataset collection | 50 substations | DNP3 | 4 | DNP3 masters / outstations | Very limited attack diversity; single-protocol scope; no MITRE mapping |
| IoT Security Testbed | Open-source automated vulnerability assessment platform for IoT devices | Low (1 device / run) | HTTP(S), UDP, FTP, SSH, Telnet | 13 | Camera, smart bulb, IoT web services | Few attacks; minimal scalability; no native IoT protocols or MITRE mapping |
| LoRaWAN MitM | LPWAN security testbed for real over-the-air experiments | Very low | LoRaWAN 1.0.2 | 2 | LoRa end devices, gateway | Very limited attack coverage; radio-dependent; unrealistic assumptions |
| CPS Microgrid | Real-time co-simulation for CPS attack impact analysis | Very low | Modbus, IEC 61850, DNP3 | 3 | IEDs, RTUs, PMUs | Low scalability; protocol limitations; proprietary hardware dependence |
| QR-GridEx | HIL-based large-scale coordinated attack simulation for smart grids | Medium | DNP3, IEC 61850, C37.118 | 10 | SCADA/WAMS, substations | Limited attack catalog; low reproducibility; energy-specific scope |
| Level | Phase | Samples | Success | Failure | p50(ms) | p95(ms) | p99(ms) |
|---|---|---|---|---|---|---|---|
| L0 | warmup | 48 | 100% | 0% | 2.96 | 3.1 | 7.6 |
| L0 | attack | 49 | 100% | 0% | 3.22 | 3.8 | 6 |
| L0 | cooldown | 49 | 100% | 0% | 3.18 | 3.62 | 6.88 |
| L3 | warmup | 49 | 100% | 0% | 3 | 3.8 | 12.25 |
| L3 | attack | 49 | 55.6% | 44.4% | 1275.74 | 2002.2 | 2002.2 |
| L3 | cooldown | 46 | 100% | 0% | 3.25 | 4.1 | 14.58 |
Cybersecurity
Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.
See all 354 papers