# NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation

arXiv: https://arxiv.org/abs/2604.04121 · HTML: https://mlsanity.com/paper/2604.04121/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 18 references that are in the map.
- First posted on arXiv 5 Apr 2026.

## Builds on (most cited first, 3 of 3)

- [Man-in-The-Middle Attacks and Defense in a Power System Cyber-Physical Testbed](https://mlsanity.com/paper/2102.11455/) (2021)
- [Gotham Testbed: a Reproducible IoT Testbed for Security Experiments and Dataset Generation](https://mlsanity.com/paper/2207.13981/) (2022)
- [SoK: The MITRE ATT&CK Framework in Research and Practice](https://mlsanity.com/paper/2304.07411/) (2023)

## Abstract (arXiv)

Cybersecurity research increasingly depends on reproducible evidence, such as traffic traces, logs, and labeled datasets, yet most public datasets remain static and offer limited support for controlled re-execution and traceability, especially in heterogeneous multi-protocol environments. This paper presents NetSecBed, a container-native, scenario-oriented testbed for reproducible generation of network traffic evidence and execution artifacts under controlled conditions, particularly suitable for IoT, IIoT, and pervasive multi-protocol environments. The framework integrates 60 attack scenarios, 9 target services, and benign traffic generators as single-purpose containers, enabling plug-and-play extensibility and traceability through declarative specifications. Its pipeline automates parametrized execution, packet capture, log collection, service probing, feature extraction, and dataset consolidation. The main contribution is a repeatable, auditable, and extensible framework for cybersecurity experimentation that reduces operational bias and supports continuous dataset generation.