[공지사항]을 빙자한 안부와 근황 
Show more

Daily Arxiv

This is a page that curates AI-related papers published worldwide.
All content here is summarized using Google Gemini and operated on a non-profit basis.
Copyright for each paper belongs to the authors and their institutions; please make sure to credit the source when sharing.

PHASE: Passive Human Activity Simulation Evaluation

Created by
  • Haebom

Author

Steven Lamp, Jason D. Hiser, Anh Nguyen-Tuong, Jack W. Davidson

Outline

This paper presents PHASE (Passive Human Activity Simulation Evaluation), a novel machine learning framework for quantitatively assessing the behavioral trustworthiness of synthetic user personas that mimic realistic human behavior to enhance the effectiveness of cybersecurity simulation environments (cyber ranges, honeypots, and sandboxes). PHASE analyzes Zeek connection logs to distinguish human and non-human activities with over 90% accuracy, and operates passively without user-side instrumentation or surveillance signatures. Network activities are collected via Zeek network appliances, and a novel labeling technique utilizing local DNS records is proposed. SHAP analysis is used to identify temporal and behavioral features that represent human users, and a case study is presented to identify and improve unrealistic patterns of synthetic users to generate more realistic synthetic users.

Takeaways, Limitations

Takeaways:
A novel method to quantitatively evaluate the behavioral trustworthiness of synthetic users is presented.
Distinguishing between human and non-human activities in a passive and non-invasive manner
Presenting an effective data labeling technique using local DNS records
Human behavior pattern analysis and synthetic user improvement possible through SHAP analysis
A more realistic and effective cybersecurity simulation environment can be built.
Limitations:
Because it relies on the Zeek log, it may not be applicable to systems that do not use Zeek.
It is possible that the model is specialized for a specific network environment. Generalization performance verification in various environments is required.
The scope of the case study may be limited. More diverse and broader scenarios need to be tested.
Further research is needed on adaptability to new types of attacks or behavioral patterns.
👍