NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation

Abstract

Cybersecurity research increasingly depends on reproducible evidence, such as traffic traces, logs, and labeled datasets, yet most public datasets remain static and offer limited support for controlled re-execution and traceability, especially in heterogeneous multi-protocol environments. This paper presents NetSecBed, a container-native, scenario-oriented testbed for reproducible generation of network traffic evidence and execution artifacts under controlled conditions, particularly suitable for IoT, IIoT, and pervasive multi-protocol environments. The framework integrates 60 attack scenarios, 9 target services, and benign traffic generators as single-purpose containers, enabling plug-and-play extensibility and traceability through declarative specifications. Its pipeline automates parametrized execution, packet capture, log collection, service probing, feature extraction, and dataset consolidation. The main contribution is a repeatable, auditable, and extensible framework for cybersecurity experimentation that reduces operational bias and supports continuous dataset generation.

Figures (4)

• Figure 1: Overview of the NetSecBed architecture.
• Figure 2: Execution pipeline of NetSecBed for artifact generation.
• Figure 3: Censored latency versus success rate under HTTP SYN Flood DoS.
• Figure 4: Target server resource usage.