Open Access

ARTICLE

Network Traffic Synthesis and Simulation Framework for Cybersecurity Exercise Systems

by Dong-Wook Kim¹, Gun-Yoon Sin², Kwangsoo Kim³, Jaesik Kang³, Sun-Young Im³, Myung-Mook Han^1,*

1 Department of AI Software, Gachon University, Seongnam-Si, 13120, Republic of Korea
2 School of Computer Engineering & Applied Mathematics, Hankyong National University, Pyeongtaek-Si, 17738, Republic of Korea
3 Cyber Electronic Warfare Research and Development, LIG Nex1, Seongnam-Si, 13488, Republic of Korea

* Corresponding Author: Myung-Mook Han. Email:

(This article belongs to the Special Issue: Security, Privacy, and Robustness for Trustworthy AI Systems)

Computers, Materials & Continua 2024, 80(3), 3637-3653. https://doi.org/10.32604/cmc.2024.054108

Received 19 May 2024; Accepted 26 July 2024; Issue published 12 September 2024

Abstract

In the rapidly evolving field of cybersecurity, the challenge of providing realistic exercise scenarios that accurately mimic real-world threats has become increasingly critical. Traditional methods often fall short in capturing the dynamic and complex nature of modern cyber threats. To address this gap, we propose a comprehensive framework designed to create authentic network environments tailored for cybersecurity exercise systems. Our framework leverages advanced simulation techniques to generate scenarios that mirror actual network conditions faced by professionals in the field. The cornerstone of our approach is the use of a conditional tabular generative adversarial network (CTGAN), a sophisticated tool that synthesizes realistic synthetic network traffic by learning from real data patterns. This technology allows us to handle technical components and sensitive information with high fidelity, ensuring that the synthetic data maintains statistical characteristics similar to those observed in real network environments. By meticulously analyzing the data collected from various network layers and translating these into structured tabular formats, our framework can generate network traffic that closely resembles that found in actual scenarios. An integral part of our process involves deploying this synthetic data within a simulated network environment, structured on software-defined networking (SDN) principles, to test and refine the traffic patterns. This simulation not only facilitates a direct comparison between the synthetic and real traffic but also enables us to identify discrepancies and refine the accuracy of our simulations. Our initial findings indicate an error rate of approximately 29.28% between the synthetic and real traffic data, highlighting areas for further improvement and adjustment. By providing a diverse array of network scenarios through our framework, we aim to enhance the exercise systems used by cybersecurity professionals. This not only improves their ability to respond to actual cyber threats but also ensures that the exercise is cost-effective and efficient.

---

Keywords

---