User Behavior Simulation in ICS Cyber Ranges

Cyber ranges, built to simulate the topologies, configurations, and runtime status of the real network, can be employed to test and verify the security and/or privacy issues of user behaviors in newly developed systems and networks in a virtual but extremely similar environment. However, most of the existing user behavior simulation methods usually suffer from low authenticity and trust in real-world user behaviors, especially for large-scale and complex industrial control systems (ICSs). To meet this gap, this paper proposes a novel user behavior simulation method for ICS cyber ranges. Specifically, we first generate coarse-grained group user behaviors and choose specific nodes to generate fine-grained individual user behaviors to fit the same software under different levels of subsystems. Then, we accelerate and replay the generated traffic by compressing the time interval to balance the packet loss rate and distortion rate. Importantly, to build a multi-granularity ICS cyber range that can simulate different types of user behaviors, we use the cloud platform to create protocol stacks, dockers, virtual machines, and physical devices. Experiment results show that the simulated user behaviors in ICS cyber ranges are highly similar to the actual network environments.