Gotham Testbed: A Reproducible IoT Testbed for Security Experiments and Dataset Generation

Abstract

The growing adoption of the Internet of Things (IoT) has brought a significant increase in attacks targeting those devices. Machine learning (ML) methods have shown promising results for intrusion detection; however, the scarcity of IoT datasets remains a limiting factor in developing ML-based security systems for IoT scenarios. Static datasets get outdated due to evolving IoT architectures and threat landscape; meanwhile, the testbeds used to generate them are rarely published. This paper presents the Gotham testbed, a reproducible and flexible security testbed extendable to accommodate new emulated devices, services or attackers. Gotham is used to build an IoT scenario composed of 100 emulated devices communicating via MQTT, CoAP and RTSP protocols, among others, in a topology composed of 30 switches and 10 routers. The scenario presents three threat actors, including the entire Mirai botnet lifecycle and additional red-teaming tools performing DoS, scanning, and attacks targeting IoT protocols. The testbed has many purposes, including a cyber range, testing security solutions, and capturing network and application data to generate datasets. We hope that researchers can leverage and adapt Gotham to include other devices, state-of-the-art attacks and topologies to share scenarios and datasets that reflect the current IoT settings and threat landscape.

Clustered Federated Learning Architecture for Network Anomaly Detection in Large Scale Heterogeneous IoT Networks

“…a) validation-attack-mirai-scan-load: Some city network devices are first configured to make them vulnerable to Mirai as detailed in [22]. The testbed's Mirai bot node is activated (A1) and starts scanning all city network devices (A2).…”

“…The experimental setup is based on the Gotham Testbed [22], a testbed to perform large-scale IoT security experiments in a realistic and reproducible way. Gotham is built on top of the GNS3 [52] network emulator, and it includes a repository of Docker images and QEMU-based virtual machines to emulate various IoT/IIoT devices, malware samples, servers and networking equipment such as switches and routers.…”

“…To create the IoT scenario, we use the default case study scenario presented at [22] composed of many heterogeneous nodes. The scenario comprises three main networks connected by 10 routers and 30 switches: the city network, the cloud network and the threat network.…”

“…The scenario comprises three main networks connected by 10 routers and 30 switches: the city network, the cloud network and the threat network. The full details are explained in [22], but here we will present a summary of the different emulated devices which are relevant for the discussion in the following sections.…”

A novel framework for analyzing internet of things datasets for machine learning and deep learning-based intrusion detection systems

“…Value: provide the number of instances in the dataset, if official information is not available, you may calculate the number of instances using the dataset. Network topology, this aspect reveals the configuration of the system and network, the context in which the system is used, how the internal network interacts with it, and if it covers a wide network or not [30]. If this dataset is simulated, it is important to describe how the testbed configuration was created because this will allow us to determine whether or not it closely resembles the real network architecture.…”