Authentic Network Traffic Emulation for Security Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for emulating attacks on computer networks often fail to accurately represent real network traffic and configurations, leading to ineffective validation of security technologies, as they either fabricate data or lack authenticity, which can result in unpredictable detection and response from security systems.
Innovation Solution
The method involves reconstructing and replaying authentic data packets from a previous attack using a PCAP file, reassembling packet fragments into complete data packets, and coordinating their transmission between agents within and outside the target network to create an authentic facsimile of the attack, ensuring that security technologies are properly configured to respond to similar real attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If authentic data packets from a previous attack are reconstructed and replayed, then the accuracy of security technology validation is improved, but the complexity of the emulation system increases
Solution Approach 1:
The patent creates a copy of authentic attack traffic by capturing real network packets during an actual attack, storing them in a PCAP file, and replaying them through emulation agents. This copying approach preserves the exact characteristics of the original attack while enabling safe validation of security technologies without exposing the target network to real threats.
Solution Approach 2:
The system performs preliminary capture and analysis of attack traffic before the actual validation process. By pre-capturing authentic packets during an initial attack phase and preparing them for replay, the system eliminates the need to generate synthetic attack patterns during validation, thereby improving accuracy while managing complexity through advance preparation.
2Reliability
If packet fragments are reassembled into complete data packets, then the authenticity of the attack emulation is improved, but the processing time and computational resources increase
Solution Approach 1:
The system performs packet reassembly and preparation in advance during the capture phase, storing reassembled complete packets in the PCAP file. This preliminary processing eliminates the need for real-time reassembly during the actual emulation validation, thereby maintaining authenticity while minimizing processing time during the critical validation phase.
3Measurement precision
If multiple agents are coordinated to transmit data packets between internal and external network locations, then the realism of the attack scenario is improved, but the system complexity and coordination overhead increase
Solution Approach 1:
The emulation system is segmented into distinct functional agents: capture agents that collect authentic traffic, replay agents that transmit packets, and coordination components that manage the emulation flow. This segmentation allows each agent to perform its specific function with optimized complexity, while the overall system achieves high realism through their coordinated interaction.
Solution Approach 2:
The patent introduces a coordination mechanism that acts as an intermediary between multiple agents, managing packet transmission timing, routing, and state synchronization. This intermediary layer simplifies the coordination overhead by providing a centralized control point that orchestrates agent interactions without requiring complex peer-to-peer communication protocols.
Data Source
AI summary
One variation of a system for emulating a known attack on a computer network includes a computer system configured to: generate a set of data packets by recombining packet fragments transmitted between machines during a prior malicious attack on a second network; define transmission triggers for transmission of the set of data packets between pairs of agents connected to a target network based on timestamps of packet fragments; generate an executable file including the set of data packets and the transmission triggers; initiate transmission of the set of data packets between the pairs assets according to the set of transmission triggers to emulate the malicious attack on the target network; and, in response to absence of a security event related to the emulation in a log of a security technology deployed on the target network, generate a prompt to reconfigure the security technology to respond to the malicious attack.