Ut-battelle, Inc.

Brian Weber

Robert A Bridges

Jared M Smith

Kiren E Verma

Jeffrey A Nichols

Oumar Souleymane Diallo

Timothy S Oesch

Whether testing intrusion detection systems, conducting training exercises, or creating data sets to be used by the broader cybersecurity community, realistic user behavior is a desirable component of a cyber-range. Existing methods either rely on network level data or replay recorded user actions to approximate real users in a network. Probabilistic models can be fit to actual user data (sequences of application usage) collected from endpoints. Once trained to the user's behavioral data, these models can generate novel sequences of actions from the same distribution as the training data. These sequences of actions can be fed to emulator software via configuration files, which replicate those behaviors on end devices. The models are platform agnostic and can generate behavior data for any emulation software package. In some embodiments a latent variable is added to faithfully capture and leverage time-of-day trends.

Growing community of inventors

Oak Ridge, TN, United States of America

Brian Weber