A Testbed for Cyber Attack Emulation and AI-Driven Anomaly Detection in Industrial IoTand OT-Networks

Legacy Industrial Control System protocols, such as Modbus, expose critical vulnerabilities in Industrial IoT environments, underscoring the urgent need for advanced security solutions. Our Operational Technology testbed is purpose-built to emulate realistic Industrial Control Network scenarios by integrating essential IT and OT components, including an Engineering Workstation and a Human-Machine Interface for supervisory control, along with Programmable Logic Controllers, an MQTT broker, and a smart switch for VLAN segmentation, in order to replicate the complexities of modern industrial networks. Together, these components form the core of our testbed, enabling not only the simulation of cyber-attack scenarios but also the generation of rich, high-fidelity datasets that are critical for training AI-based anomaly detection models. To our knowledge, this is the first generic cyber attack testbed for deep field buses, enabling systematic attacks and analyses. The collected data, which encompasses network traffic, telemetry, and host logs, is processed through a centralized Elastic Security Information and Event Management system augmented by local monitoring tools such as NetFlow, Auditd, and Zeek. This paper details the design, implementation, and evaluation of our testbed, demonstrating its adaptability to emulate various attack scenarios and its effectiveness in producing datasets that advance cybersecurity in Industrial Control networks.