A distributed simulation framework for modeling cyber attacks and the evaluation of security measures

Abstract

The aim of this work is to propose a framework for the distributed simulation of cyber attacks based on high-level architecture (HLA), which is a commonly used standard for distributed simulations. The proposed framework and the corresponding simulator, which is called the distributed cyber attack simulator (abbreviated by DCAS), help administrators to model and evaluate the security measures of the networks. At the core of the DCAS is a simulation engine based on Portico, which is an open source HLA run-time infrastructure. The DCAS works in two modes: interactive and automated. Three types of simulation components (which are called federates in HLA terminology) are considered in the framework: the (1) network federate, (2) attacker federate and (3) defender federate. The simulator provides features for graphical design of the network models, animated traffic simulation, data collection, statistical analysis and different consoles for attacking and defending elements (e.g., intrusion detection systems, intrusion prevention systems). To increase the fidelity of the simulation outputs, real-world payloads are used by the DCAS. All the exploits information and the parameters of various network elements are automatically extracted from the open source vulnerability database. Also, the Snort rule-set is used as the signature database of the defending elements. The architecture and algorithms of the DCAS and the corresponding underlying simulation engine plus the security evaluation results of two illustrative examples are presented in this paper.

Cyber risk and cybersecurity: a systematic review of data availability

“…Another prediction method was presented by Fan et al (2018), which showed an improved integrated cybersecurity prediction method based on spatial-time analysis. Also, with reference to prediction, Ashtiani and Azgomi (2014) proposed a framework for the distributed simulation of cyberattacks based on high-level architecture. Kirubavathi and Anitha (2016) recommended an approach to detect botnets, irrespective of their structures, based on network traffic flow behaviour analysis and machine-learning techniques.…”

A systematic review of cyber-resilience assessment frameworks

“…Likelihood Est. Univ Georgia,US [45] Bayesian Networks Univ Limerick,IE [123]; George Mason Univ,US [76]; Benedict Coll,US & Univ Illinois,US [69]; Missouri Univ Sci Tech,US [81]; World Islamic Sci Edic Univ,JO & Royal Jordanian Air Forces,JO [ [118] Bounded sensor reading Nanyang Tech Univ,SG [47] Convex Optimization South China Univ Tech,CN [127] Distributed Attack Iran Sci Univ Tech,IR [54] Hierarchical Modeling MIT,US [77] LiSM: Land in Sand Miner NEC Labs Amer,US & Univ Illinois,US & BBN Tech,US [86] Montecarlo Politech Milan,IT & Univ Paris,FR [48] Penetration Testing Malek Ashtar Univ Tech,IR & NIOPDC,IR [26]; US Air Force,US [29] Process Northeastern Univ,CN [128]; Singapore Univ Tech Design,SG & Optiwater,IL & Technion Israel Inst Tech,IL [49]; Shenandoah Res Tech,US [90] Reliability Univ Idaho,US & Texas A&M Univ,US [57] Robust predictive control Northeastern Univ,CN [119] Stochastic Hypothesis Testing Univ Florida,US & Univ Sao Paulo,BR [70] Continued on next page Survey General Shanghai Univ,CN [67]; Univ Hull,UK [92]; MIT,US [82] 6 Analysis and future work…”

Presenting a method to perform cyber maneuvers

“…They also mentioned previous studies on this issue. Furthermore, [15] presented a simulation of cyberattacks with a distribution approach. Distribution enables people and programs to interact in different geographic locations.…”