IoT-Zoo: A Container-Based Framework for Heterogeneous IoT Device Profiles and Reproducible Traffic Capture

Vagner E. Quincozes; Diego Kreutz; Silvio E. Quincozes

cs.NIApr 7, 2026

IoT-Zoo: A Container-Based Framework for Heterogeneous IoT Device Profiles and Reproducible Traffic Capture

Authors: Vagner E. Quincozes, Diego Kreutz, Silvio E. Quincozes

Organizations: Federal Fluminense University (UFF) · AI Horizon Labs and PPGES – Federal University of Pampa (UNIPAMPA)

Abstract

The validation of networking and security solutions for the Internet of Things (IoT) requires realistic and reproducible experimental data. However, existing platforms often achieve scalability by replicating a limited set of device types, which restricts profile diversity and fails to capture the heterogeneity of real-world IoT environments. In this paper, we present IoT-Zoo, a container-based testbed designed to support reproducible experimentation through heterogeneous, dataset-driven IoT device profiles. Built upon Containernet, IoT-Zoo automates the deployment of multi-domain scenarios and supports real application protocols such as MQTT and RTSP. The platform provides a single-command interface for environment provisioning and automated traffic capture (PCAP), enabling the generation of consistent traffic baselines and reducing the operational effort required to evaluate networking and security solutions.

Figures & tables

Testbed / Project	Infrastructure	Diversity (Profiles & Sensors)	Reproducibility
IoT-Flock [ 7 ]	Virtual (Traffic Generator / GUI)	4 sensor types (temperature, humidity, motion, light)	High
Automated IoT Testbed [ 17 ]	Physical	2 device types (1 camera and 1 smart bulb).	Low
MQTT DoS Testbed [ 16 ]	Physical / Virtual mixed	5 sensor types (motion, air quality, clock, temperature, gas).	Low
TON_IoT [ 12 ]	Hybrid (SDN, NFV, Fog/Edge)	7 simulated sensors (via Node-RED) + 3 physical devices.	Medium
DoS/DDoS MQTT [ 1 ]	Physical	13 sensor types (analog and digital sensors).	Low
ICSSIM [ 5 ]	Emulated / Physical	1 industrial process (bottle-filling factory with 2 PLCs).	High

Tabla I : IoT testbeds and traffic generation frameworks.

Fig. 1 : Architecture of the IoT-Zoo emulation testbed, illustrating the separation between build, orchestration, emulation, and data collection layers.

Fig. 2 : IoT-Zoo testbed topology highlighting device heterogeneity.

Domain	Variable / Profile	Sources
Air Quality	Carbon Monoxide (CO)	36
	Nitrogen Dioxide (NO 2 )	34
	Nitric Oxide (NO)	34
	Nitrogen Oxides (NO x )	28
	Ozone (O 3 )	28
	Particle Count	26

Tabla II : Newcastle Urban Observatory subset (2025) for Smart City profiles.

Device	Pkts	IAT(s)	Jit(s)	Device	Pkts	IAT(s)	Jit(s)
Building Rooms	269	2.2111	2.5412	Urban Air: PM10	2989	0.2003	0.3415
Build: Int. Hum.	301	1.9987	1.6460	Urban Air: PM2.5	3055	0.1960	0.3390
Build: Int. Temp.	302	1.9857	1.6513	Urban Air: PM4	2462	0.2433	0.4289
Ind. Motor (Cooler)	121	4.9588	0.4547	Urban Air: Particle	2450	0.2445	0.4297
Legacy Air Sensor	74	7.9919	6.2948	Water L: Abs	1812	0.3292	1.2396
Mobility Sensor	2292	0.2605	1.8041	Water L: Rel	1380	0.4322	1.4048

Tabla III : Network metrics for representative IoT device profiles.

Device Category	Total Profiles	Mem. Usage (MiB) ( $\mu\pm\sigma$ )	CPU Peak (%)
Air Quality Sensors	10	$48.65\pm 1.98$	$11.75$
Weather & Environment	5	$48.65\pm 2.02$	$12.04$
Water Monitoring	6	$48.62\pm 2.03$	$11.26$
Built Environment / Smart Infra.	8	$20.82\pm 16.24$	$38.41$
Human-Centric Monitoring	3	$27.18\pm 16.37$	$7.71$
Industrial / Predictive Maintenance	6	$16.83\pm 12.15$	$7.67$

Tabla IV : Resource Consumption Profile by Device Category (

T=600s

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 3 : Example of MQTT traffic captured from an IoT-Zoo execution (PCAP inspection in Wireshark).

Fig. 4 : Decoded MQTT PUBLISH packet showing an example of the application payload replayed from the dataset.

Internet of Things

The Internet of Things (IoT) connects networked sensors, devices, and systems for sensing, communication, and automated action.

See all 105 papers

NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation
Apr 5, 2026Leonardo Bitzki, Diego Kreutz, Tiago Heinrich +4Cybersecurity Synthetic Data Generation
Federal University of Rio Grande do Sul (UFRGS) · AI Horizon Labs and PPGES – Federal University of Pampa (UNIPAMPA) · Max Planck Institute for Informatics (MPI-INF)
Unsupervised Baseline Clustering and Incremental Adaptation for IoT Device Traffic Profiling
Feb 27, 2026Sean M. Alderman, John D. HastingsInternet of Things Clustering
The Beacom College of Computer & Cyber Sciences, Dakota State University, Madison, SD, USA
VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents
Jul 10, 2026Katherine Swinea, Kshitiz Aryal, Lopamudra Praharaj +1Cybersecurity LLM Agent Security
Department of Computer Science, Tennessee Tech University, TN, USA. · School of Interdisciplinary Informatics, University of Nebraska Omaha, NE, USA. · Dept. of Mathematics & Computer Science, University of North Carolina at Pembroke, NC, USA.

Apr 5, 2026J/K move · Enter open · S save

NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation

Leonardo Bitzki, Diego Kreutz, Tiago Heinrich, Douglas Fideles+3

Federal University of Rio Grande do Sul (UFRGS) · AI Horizon Labs and PPGES – Federal University of Pampa (UNIPAMPA) · Max Planck Institute for Informatics (MPI-INF)

Cybersecurity Synthetic Data Generation

Open paper AskPDF arXiv

Cybersecurity research increasingly depends on reproducible evidence, such as traffic traces, logs, and labeled datasets, yet most public datasets remain static and offer limited support for controlled re-execution and traceability, especially in heterogeneous multi-protocol environments. This paper presents NetSecBed, a container-native, scenario-oriented testbed for reproducible generation of network traffic evidence and execution artifacts under controlled conditions, particularly suitable for IoT, IIoT, and pervasive multi-protocol environments. The framework integrates 60 attack scenarios, 9 target services, and benign traffic generators as single-purpose containers, enabling plug-and-play extensibility and traceability through declarative specifications. Its pipeline automates parametrized execution, packet capture, log collection, service probing, feature extraction, and dataset consolidation. The main contribution is a repeatable, auditable, and extensible framework for cybersecurity experimentation that reduces operational bias and supports continuous dataset generation.

Abstract

Internet of Things

Explore similar work

NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation

Unsupervised Baseline Clustering and Incremental Adaptation for IoT Device Traffic Profiling

VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents