Home IoT deception and defence simulator
An isolated network simulator for studying how decoy IoT services, telemetry, and defensive rules reveal suspicious activity in a home-network model.
Project definition
Problem statement
Home IoT devices often expose small network services with limited logging, making scans, repeated login attempts, and unusual communication difficult to study safely.
The engineering problem is to emulate a bounded home network, place believable decoy services, collect useful telemetry, and compare defensive rules without exposing real devices or the public internet.
Project objectives
- Model selected IoT devices, network segments, services, and normal traffic patterns.
- Deploy decoy services that record interaction without providing a real attack platform.
- Replay prepared benign and suspicious traffic inside the isolated network.
- Correlate network and decoy events into understandable alerts and timelines.
- Measure detection, false alerts, response time, and telemetry completeness.
System design
System modules
Topology simulator
Creates emulated device profiles, network segments, services, and normal communication patterns.
Decoy services
Expose controlled protocol behaviours and record connections, requests, and authentication attempts.
Traffic scenario runner
Replays prepared normal, scan, login, and command-and-control-like traces inside the lab.
Detection engine
Applies network and behavioural rules and correlates related events into alerts.
Defence dashboard
Shows topology, event timelines, decoy interactions, alerts, rule evidence, and response actions.
Methodology
System workflow
- 01Start topology
The student selects a prepared home-network profile and starts its emulated devices and decoys.
- 02Establish baseline
Normal traffic is replayed and expected services and events are recorded.
- 03Run scenario
A prepared suspicious traffic trace is replayed only within the isolated Docker network.
- 04Detect and correlate
Rules process network and decoy telemetry and build an evidence-linked alert timeline.
- 05Compare defences
A segmentation or rule change is applied and the same scenario is rerun for comparison.
Demonstration scenario
The simulator starts a router, camera, smart plug, and two decoy services. Normal traffic establishes the baseline, then a prepared scan and login sequence runs inside the lab. The dashboard correlates the events, identifies the decoy interaction, and compares the result after a network-segmentation rule is enabled.
Engineering
Technical architecture
- Web application
- Nuxt and Vue for topology control, scenario runs, alert timelines, rule evidence, and comparison.
- Lab API
- FastAPI for topology state, scenario orchestration, telemetry, alerts, and experiment records.
- Data layer
- PostgreSQL for devices, scenarios, events, alerts, rules, responses, and experiment results.
- Network telemetry
- Containerised emulators and Suricata-compatible events with prepared packet traces and decoy logs.
- Safety controls
- Private Docker networks, no public listeners, fixed scenarios, rate limits, and resettable lab state.
Testing
Evaluation
Evaluation measures
- Alert precision and recall across prepared benign and suspicious scenarios
- Time from first suspicious event to correlated alert
- Telemetry completeness across emulated device and decoy services
- False-alert rate during normal traffic scenarios
- Effect of segmentation and rule changes on scenario outcomes
- Repeatability of events and results after lab reset
System boundaries
- All devices, services, and traffic sources are emulated or safely prepared for the laboratory.
- The simulator has no route for testing public or third-party systems.
- Prepared suspicious traces demonstrate detection concepts and do not include destructive payloads.
- The project evaluates defensive controls and does not claim to protect every IoT device or protocol.
Included
- 01Isolated home-IoT topology and scenario controls
- 02Decoy service, telemetry, detection, and response modules
- 03Event timeline and defensive-analysis dashboard
- 04Prepared traffic scenarios, rules, and evaluation results
- 05Complete source code in a private GitHub repository
- 06Complete project documentation with synopsis, abstract, methodology, network diagrams, test results, screenshots, and conclusion
- 07Setup and usage guide
Project record
No buyer information is collected on this page.
- Permanent project ID
- GP-CY-03LIWR8
- Catalogued
- 21 Aug 2026
- Completed
- Pending
- Verified
- Pending
- Demonstration
- Added when ready
Handover
After purchase
- 01Payment is confirmed
The project is marked unavailable and cannot be purchased again.
- 02Repository access is granted
The buyer's submitted GitHub account receives access to the private repository.
- 03The purchase record is delivered
The certification sheet is prepared from the reviewed buyer details and sent privately by email.