How gotedyz/mirai works
This repository is a PNETLab lab for generating Mirai and benign IoT traffic, capturing it, and analyzing it with an N-BaIoT/AfterImage machine-learning pipeline. The documented workflow configures the lab network, runs scenarios from IoT-Cam-1 while SOC-Sniffer captures PCAPs, extracts features, compares supervised and anomaly-detection models, and produces a SOC report recommending quarantine. Router quarantine is applied manually. The README documents these stages; device scripts and network configurations were not sampled, so their internal behavior is not detailed here.
Main entry points: soc-sniffer SOC sniffer · sw-core Core switch · iot-cam-1 IoT camera · 01_extract_nbaiot_115_features.py Feature extractor
Components 14
Lab deployment
- PNETLab host
scripts/pnetlab-host - Web victim
scripts/victima-web - Home router
configs/router-hogar - Core switch
configs/sw-core
Traffic and capture
- IoT camera
scripts/iot-cam-1 - SOC sniffer
scripts/soc-sniffer - Scenario PCAPs
scripts/soc-sniffer
AI analysis
- Feature extractor
ai-pipeline/01_extract_nbaiot_115_features.py - Feature dataset
ai-pipeline/01_extract_nbaiot_115_features.py - Model evaluation
ai-pipeline/02_train_evaluate_models.py
SOC response
- SOC alert report
ai-pipeline/02_train_evaluate_models.py - Soft quarantine
configs/router-hogar
Other components
- Lab operator
- Google Colab
Connections 17
- Lab operator → PNETLab host: prepares images
README.md - Lab operator → Web victim: installs and configures
README.md - Lab operator → IoT camera: runs scenarios
README.md - Lab operator → SOC sniffer: starts capture
README.md - Lab operator → Home router: applies configuration
README.md - Lab operator → Core switch: applies configuration
README.md - Core switch → SOC sniffer: mirrors traffic
README.md - IoT camera → Scenario PCAPs: generates traffic
README.md - SOC sniffer → Scenario PCAPs: records scenarios
README.md - Scenario PCAPs → Feature extractor: provides captures
ai-pipeline/01_extract_nbaiot_115_features.py - Feature extractor → Feature dataset: writes features
ai-pipeline/01_extract_nbaiot_115_features.py - Feature dataset → Model evaluation: loads CSV
ai-pipeline/02_train_evaluate_models.py - Model evaluation → SOC alert report: writes findings
ai-pipeline/02_train_evaluate_models.py - SOC alert report → Lab operator: recommends action
ai-pipeline/02_train_evaluate_models.py - Lab operator → Soft quarantine: applies mitigation
README.md - Lab operator → Google Colab: uses notebook
README.md - SOC sniffer → Google Colab: syncs for analysis
README.md