Defense against Mirai infection

I am trying to build a project to analyse pre-infection of Mirai malware. I have a router, an IoT device and an attacker machine. The attack is launched from the attacker machine that runs a Mirai like software to brute-force a default username and password list in the IoT device through router. I want to run Scapy on router to sniff and detect telnet login attempts, time between the logins, match usernames and passwords and detect IP addresses. Analyze existing Mirai packets to check conditions