🤖 AI

NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation

This paper introduces NetSecBed, a container-native, scenario-oriented testbed that automates the reproducible generation of network traffic evidence and execution artifacts across heterogeneous multi-protocol environments to address the limitations of static cybersecurity datasets.

Original authors: Leonardo Bitzki, Diego Kreutz, Tiago Heinrich, Douglas Fideles, Leandro Bertholdo, Silvio Quincozes, Angelo Diniz

Published 2026-04-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Leonardo Bitzki, Diego Kreutz, Tiago Heinrich, Douglas Fideles, Leandro Bertholdo, Silvio Quincozes, Angelo Diniz

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a detective trying to solve a crime, but every time you try to recreate the crime scene in your living room, the furniture moves, the lighting changes, and the witnesses give you different stories. You can't prove anything because you can't get the exact same result twice.

This is the current problem in cybersecurity research. Scientists try to study how hackers attack computer networks, but the "evidence" they collect (like traffic logs and attack data) is often messy, static, or impossible to recreate exactly. If a researcher in Brazil studies a specific hack today, a researcher in Germany might not be able to repeat that exact experiment tomorrow because their computers, software versions, or network settings are slightly different.

NetSecBed is the solution to this problem. Think of it as a "Lego Cyber-Lab" that guarantees you can build the exact same digital crime scene, over and over again, no matter who is building it.

Here is how it works, broken down into simple concepts:

1. The "Container" Kitchen (The Core Idea)

Imagine you want to bake a cake. In the old days, you'd have to find the exact same brand of flour, the same oven temperature, and the same humidity in the room to get the same cake twice. That's hard.

NetSecBed uses containers (a technology that packages software like a sealed lunchbox).

The Attackers: Instead of a hacker running messy scripts on a real computer, the "hacker" is a pre-packaged lunchbox.
The Victims: The "victims" (like a website or a smart lightbulb) are also pre-packaged lunchboxes.
The Result: You can drop these lunchboxes into the lab, and they will behave exactly the same way every single time. No matter what computer you put them on, the "cake" (the experiment) turns out identical.

2. The "Recipe Book" (Declarative Specifications)

In the past, telling a computer to run an attack was like giving a friend a vague verbal instruction: "Hey, try to break that website, maybe send a lot of data, but not too much." This leads to mistakes.

NetSecBed uses a Recipe Book (written in a simple language called YAML).

The recipe says exactly: "Use Attack #42, target the Web Server, run for 10 seconds, at 100% intensity."
Because the recipe is written down clearly, anyone can read it and execute the exact same experiment. This removes human error and "operational bias" (where the researcher accidentally changes the results by being too tired or too excited).

3. The "Black Box" Recorder (Traceability)

When a real car crash happens, we have black boxes that record everything: speed, braking, engine noise.

NetSecBed is a digital black box.

When an attack runs, it doesn't just say "It failed." It records everything: every single data packet sent, every log file created, and exactly how long the attack lasted.
It separates the "attack" from the "recording." This means you can replay the attack years later and see exactly what happened, down to the millisecond.

4. The "Toy Box" of Scenarios

The authors have already built a massive Toy Box containing:

60 different "attacks" (from annoying spam to serious crashes).
9 different "victims" (websites, databases, smart home devices, industrial machines).
Benign traffic (fake "good" users walking around so the attack doesn't look suspicious).

You can mix and match these toys. Want to see what happens if you attack a smart thermostat while people are trying to watch Netflix? Just pick the "Thermostat" victim, the "Netflix" background noise, and the "Attack" toy, and the system runs it automatically.

The Real-World Test (The "DoS" Experiment)

To prove it works, the team tested a SYN Flood attack (a type of attack that overwhelms a server with too many requests, like a crowd of people trying to push through a single door at once).

The Setup: They ran the attack at a low level (L0) and a high level (L3).
The Result:
- Low Level: The website didn't even notice. It was like a gentle breeze.
- High Level: The website slowed down massively. It went from responding in 3 milliseconds to taking over 1.2 seconds to respond. It was like the door was jammed shut.
- The Recovery: As soon as they stopped the attack, the website instantly went back to normal.

This proved that NetSecBed can measure exactly how bad an attack is and how long it takes to recover, with perfect precision.

Why Should You Care?

In the past, cybersecurity datasets were like frozen fossils—they were old, static, and didn't reflect how hackers operate today.

NetSecBed is a living, breathing factory.

For Researchers: It means they can trust their data. If they publish a paper saying "This defense works," other scientists can run the exact same experiment and verify it.
For the Future: As new devices (like smart fridges or self-driving cars) are invented, we can just "plug in" a new container to the system and start testing them immediately.

In short: NetSecBed turns cybersecurity research from a messy, one-time art project into a precise, repeatable science. It ensures that when we study how to stop hackers, we are all looking at the exact same evidence.

1. Problem Statement

Cybersecurity research increasingly relies on reproducible evidence (traffic traces, logs, labeled datasets) to evaluate detection and response mechanisms. However, the current state of the art faces significant challenges:

Static and Obsolete Datasets: Public datasets are often static, failing to reflect continuous changes in service behaviors, protocol stacks, and adversarial strategies.
Lack of Reproducibility: Generating evidence in heterogeneous environments (spanning traditional protocols like HTTP/SSH and IoT/IIoT protocols like MQTT/CoAP/Zenoh) is difficult due to variations in software versions, timing, and configuration.
Fragmented Testbeds: Existing testbeds often optimize for isolated dimensions (e.g., physical realism or specific protocols) but suffer from limited attack coverage, poor scalability, and a lack of systematic re-execution capabilities.
Operational Bias: Many approaches rely on manual pipelines or domain-coupled scenarios, hindering comparability and the incremental evolution of experimental environments.

The core problem is the need for a system that can systematically generate experimental evidence in a repeatable, auditable, and extensible manner, preserving full traceability of origin, parameters, and execution conditions.

2. Methodology and Architecture

NetSecBed addresses these issues through a container-native, scenario-oriented architecture that treats experimentation as a controlled, observable pipeline rather than an isolated operational task.

Core Architectural Principles

The framework is built on four methodological principles:

Strict Component Isolation: Every component (attacker, target, benign client) is encapsulated in a single-purpose container.
Standardized Execution: Experiments follow a controlled lifecycle (Warmup $\rightarrow$ Attack $\rightarrow$ Cooldown).
Declarative Extensibility: Scenarios are defined via metadata (YAML) rather than hard-coded logic.
End-to-End Traceability: All artifacts (pcaps, logs, metrics) are linked to execution parameters.

System Components

Containerized Artifact Repository:
- Contains 60 attack scenarios, 9 target services (Web, MySQL, SSH, Telnet, SMB, MQTT, CoAP, Zenoh, XRCE-DDS), and parameterizable benign traffic generators.
- Each attack is an independent container with a Dockerfile and an entrypoint.sh hook.
- Metadata includes MITRE ATT&CK mappings, linking the "why" (tactic) and "how" (technique) of each attack.
Orchestration Engine:
- Translates abstract specifications into an executable workflow.
- Manages the Warmup-Attack-Cooldown lifecycle to separate service stabilization, adversarial interference, and recovery.
- Performs continuous availability and latency probing to label samples by temporal phase.
Data Processing & Artifact Generation:
- Captures raw traffic (pcap), service logs, and telemetry.
- Uses multiple independent extractors (TShark, Scapy, NTLFlowLyzer) to ensure robustness and allow for bias analysis.
- Consolidates data into standardized tabular datasets, visual reports, and execution evidence.

Experimental Formalization

Experiments are modeled as a tuple $E = (C, P, B, I, R)$ :

$C$ : Scenario (attack, target, topology).
$P$ : Parameter space (rate, duration, port).
$B$ : Benign baseline (traffic profile).
$I$ : Instrumentation plan (pcap, logs).
$R$ : Repetition plan (runs, windows).

3. Key Contributions

Container-Native Architecture: A fully isolated, reproducible environment where attackers, targets, and benign traffic are containerized, ensuring strict execution isolation and auditability.
Structured Attack Catalog: A library of 60 attacks supporting heterogeneous protocols (Traditional + IoT/IIoT) with explicit MITRE ATT&CK mappings.
Automated Pipeline: A complete workflow for parametrized execution, packet capture, log collection, feature extraction, and dataset consolidation.
Declarative Extensibility: New attacks or services can be added via YAML specifications and Docker containers without modifying the system core, addressing the "maintenance overhead" limitation of prior work.
Methodological Framework: Reduces operational bias by separating execution from interpretation and preserving raw evidence for re-analysis.

4. Results and Evaluation

The authors evaluated NetSecBed using a DoS SYN Flood attack against an HTTP service, comparing a low-intensity level (L0) and a high-intensity level (L3).

L0 (Low Intensity): The service remained stable with a 100% success rate and low latency (p50 $\approx$ 3ms) across all phases (warmup, attack, cooldown).
L3 (High Intensity):
- Success Rate: Dropped to 55.6% during the attack phase.
- Latency: Median latency (p50) surged to 1275.74 ms, with p95/p99 reaching 2002.2 ms (near the timeout threshold).
- Recovery: The system returned to 100% success and baseline latency immediately after the attack ceased (cooldown phase), proving the degradation was temporally localized.
Resource Metrics:
- CPU: Showed immediate oscillation and peaks coinciding with the attack onset.
- System Load: Load1 spiked sharply during the attack; Load5/Load15 showed smoother but elevated trends.
- Memory: Increased from ~76% to ~90% during the attack, with only partial recovery by the end of the observation window.

These results demonstrate NetSecBed's ability to produce phase-aware, quantitatively reproducible evidence of service degradation and resource pressure.

5. Significance

NetSecBed represents a significant advancement in cybersecurity research infrastructure by:

Bridging the Gap: It unifies traditional and IoT/IIoT environments, supporting protocols like MQTT, CoAP, Zenoh, and XRCE-DDS alongside standard web services.
Enabling Continuous Dataset Generation: Unlike static repositories, NetSecBed allows researchers to generate up-to-date, labeled datasets on demand, adapting to evolving threats and protocols.
Improving Scientific Rigor: By enforcing strict traceability, declarative specifications, and automated pipelines, it reduces operator bias and enables fair, comparable evaluation of detection mechanisms across heterogeneous experiments.
Scalability: The container-native design allows for high scalability (tested on commodity hardware) and easy deployment in both virtualized and bare-metal environments.

In conclusion, NetSecBed provides a robust, extensible, and auditable framework that shifts cybersecurity experimentation from static data analysis to dynamic, reproducible evidence generation, particularly vital for the complex, heterogeneous landscapes of IoT and pervasive computing.