A hardened gateway on real hardware.

The brief

The 2016 Mirai botnet compromised hundreds of thousands of IoT devices — cameras, thermostats, routers — mostly because those devices had no meaningful defenses at the edge. Nearly a decade later, most IoT deployments still trust the network and hope for the best.

The project brief was to build a working defense in depth on a real edge device: firewall, encrypted transport, message integrity, replay protection, intrusion detection and anomaly detection, all running together, all reproducible.

What I built

• Hardware. A physical Raspberry Pi 5 running Debian Trixie arm64. Not a VM — an actual box.
• Firewall. nftables rules that only allow the specific ports and directions the gateway actually needs.
• Encrypted transport. Mosquitto MQTT broker with TLS and ACL — every sensor authenticates and every message is encrypted in flight.
• Message integrity. HMAC-SHA256 signatures on every payload — if a byte changes in transit, the message is rejected before it hits the database.
• Replay protection. A per-sensor frame counter (FCnt) with SQLite-backed persistence across restarts, so replaying an old valid packet is caught within a second.
• Intrusion detection. Suricata IDS on the ingress interface, flagging port scans and known malicious patterns.
• AI anomaly detection. An Isolation Forest trained on 480 windows per device, catching behavioural drift (constant RSSI, packet-rate spikes) that passes every cryptographic check but shouldn't happen.
• Observability. A three-panel Grafana dashboard — telemetry, security alerts, statistics — fed by a Python collector and a Flask REST API with /telemetry, /alerts, /stats and /health endpoints.
• Auto-start. All six services (Mosquitto, collector, simulator, API, anomaly engine, Grafana) wired as systemd units — the box comes up ready to defend itself on boot.
• Attack drill. Four attack scripts — replay, HMAC tampering, port scan, anomaly injection — used both as validation and as the demo video.

Project report

Analysis

The attack drill runs cleanly. Replay attempts are rejected in under a second with an audit trail. HMAC-tampered payloads never reach the database. The anomaly injection is subtle by design — the HMAC is correct, the RSSI stays constant, the packet rate rises — and the Isolation Forest catches it: the anomaly score for the affected sensor drops from ~0.26 down to ~0.11 while the other sensors stay in the normal band. Everything is visible in the Grafana panels, correlated by timestamp.

The value of the project isn't in any single component — those are all known techniques. It's in the composition: showing that a $80 board, correctly configured, can enforce all of these guarantees at once, on boot, in a way that survives real-world deployment.