CONTAINERIZED IOT CYBER RANGE: SECURITY ASSESSMENT AND SOC INTEGRATION IN MQTT ENVIRONMENTS

The expansion of the Internet of Things (IoT) in critical domains makes securing Machine-to-Machine protocols essential. MQTT, the de facto standard, is historically "insecure by default" exposing networks to growing threats. This thesis proposes the development of a containerized IoT Cyber Range to execute MQTT security tests in an isolated, scalable, and reproducible manner on commodity hardware. Leveraging Infrastructure as Code (Docker Compose), the system orchestrates an isolated L2 network containing legitimate IoT nodes, an adversarial node, and an observability stack (Prometheus, Loki, Grafana) acting as an integrated Security Operations Center (SOC). System validation compares two scenarios: a vulnerable baseline and a hardened environment implementing security best practices for MQTT deployments (TLS v1.2, password-based authentication, and ACLs). By deploying the system on a natively v5.0-compliant infrastructure, this architectural choice ensures forward compatibility and establishes a baseline for the subsequent evaluation of v5.0-exclusive mechanisms (e.g., Enhanced Authentication). The testbed was subjected to attacks targeting the CIA Triad: credential Brute Force, ACL violations, and Volumetric DoS. The system quantitatively evaluates the SOC's detection effectiveness and the computational overhead (CPU, RAM) of the applied countermeasures, demonstrating the viability of containerized architectures for IoT security. To bridge this research gap, this thesis proposes the design and development of a pure-container IoT Cyber Range, orchestrated through a lightweight Infrastructure as Code (IaC) approach. The proposed architecture leverages OS-level virtualization to drastically reduce infrastructural overhead, ensuring a decrease in memory and storage consumption compared to traditional systems, combined with the total automation and repeatability of experiments. Specifically, the developed framework focuses on the emulation of IoT network topologies for the advanced security analysis of the MQTT protocol. This work integrates and tests the features introduced by MQTT v5.0 (including Enhanced Authentication, AUTH packets, and Reason Codes), enabling a direct comparative analysis of the performance overhead generated by these defense mechanisms. The result is a scalable, reproducible, and accessible testing environment that provides researchers and professionals with an effective tool for IoT security validation, without the need for resource-intensive server infrastructures.