SDCI Sec: Traffic modeling and generation with custom fidelity for cyber security experimentation

流量生成是网络试验台网络安全防御测试的重要组成部分。生成任何流量都很容易，但生成真实的流量却很难。关键原因是“现实”对不同的人意味着不同的东西。真实感的定义取决于测试中流量的使用，但所有现有的流量生成器都有一个固定的真实性定义，用户不能更改。该项目将建立一个流量生成器，其现实主义的定义可以完全由用户指定。生成器将由三个模块组成：(1)从流量日志中挖掘用户指定维度的值的模块，(2)生成符合上一步中挖掘的模型的随机流量的模块，(3)重放日志中的流量以使其与用户指定维度上的记录流量完全匹配的模块。通过允许用户指定他们自己的现实维度，该项目的流量生成工具将足够通用，以满足任何网络安全研究人员的评估需求。此外，在单个工具中集成从模型生成流量和重放流量是新颖的；现有工具仅支持其中一种生成方法。最后，该工具将支持应用、传输或网络级别的流量生成，而现有工具仅支持一个选定的级别。广泛影响：拟议的工作将支持对其产品进行严格和现实的评估，从而推动网络安全防御研究。它既满足了研究人员的需求，又非常便携，易于部署和使用，从而实现了这一点。由于用户将能够根据他们的需要定制现实主义的定义，因此评估将适当地强调网络安全防御，其结果将预测防御在实际部署中的性能。流量生成器能够从学习的模型中生成流量，并从网络日志中重放流量，从而实现了一系列测试策略，并支持对问题空间的彻底探索。更好的评估策略将带来更好的网络安全防御。该项目将把我们的流量生成器与用于网络安全实验的威慑试验台集成在一起。所有软件也将在GNU GPL v3许可证下以开源形式发布。

Traffic generation plays an integral part of cyber-security defense testing in network testbeds. Generating just any traffic is easy, but generating realistic traffic is hard. The key reason for this is that "realistic" means different things to different people. The definition of realism depends on the use of the traffic in testing, but all existing traffic generators have a fixed definition of realism that users cannot change. This project will build a traffic generator whose definition of realism can be fully specified by a user. The generator will consist of three modules: (1) a module that mines values for user-specified dimensions from traffic logs, (2) a module that generates random traffic that fits the model mined in the previous step, (3) a module that replays traffic from a log so that it exactly matches the logged traffic along the user-specified dimensions.Intellectual Merit: The key novelty of this approach lies in the customizable definition of realism that the generator will support. By allowing users to specify their own reality dimensions this project's traffic generation tool will be generic enough to meet the evaluation needs of any cyber security researcher. Further, integration of the traffic generation from models and traffic replay in a single tool is novel; existing tools support only one of these generation approaches. Finally, the tool will support traffic generation at application, transport or network level while existing tools support it only at one select level.Broader Impact: The proposed work will advance cyber-security defense research by supporting rigorous and realistic evaluation of its products. It will do that by both fitting researchers' needs and by being extremely portable and easy to deploy and use. Because users will be able to customize the definition of realism as they desire, the evaluation will properly stress the cyber-security defenses and its results will be predictive of the defenses performance in real deployment. The traffic generator's capabilities to both generate traffic from learned models and to replay it from network logs enable a wide range of testing strategies and support thorough exploration of problem space. Better evaluation strategies will lead to better cyber-security defenses. The project will integrate our traffic generator with the DETER testbed for cyber security experimentation. All software will also be released as open-source under the GNU GPL v3 license.