Simulated Communication Modeling for Realistic Cyber Deception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber deception methods face challenges in creating realistic communication patterns for honeypots due to the high computational complexity and difficulty in parameterizing traffic patterns, making it hard to entice attackers effectively.
Innovation Solution
A method using a combination of temporal point processes (TPP) and a trained generation model like GPT to generate realistic communication data by jointly modeling sending times and participants, ensuring the generated messages are highly realistic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If realistic traffic patterns are created for honeypots, then the effectiveness of cyber deception is improved, but computational complexity increases
Solution Approach 1:
The system performs preliminary actions by pre-training the GPT language model on historical communication data before deployment. This pre-training captures realistic communication patterns, sender-recipient relationships, and temporal dynamics. During runtime, the honeypot system only needs to sample from the pre-trained model, significantly reducing computational complexity while maintaining high realism in generated traffic patterns
Solution Approach 2:
The system creates copies of real communication patterns by training the GPT model on historical data from the target network. The model learns and replicates authentic sender behaviors, recipient selection patterns, message timing, and communication topics. These copied patterns are then generated synthetically to populate honeypots with realistic traffic that mimics legitimate network activity without requiring actual network data
2Reliability
If detailed and plausible communication behaviors are generated, then attacker engagement is improved, but difficulty in parameterizing traffic patterns increases
Solution Approach 1:
The system transforms the parameterization challenge into a learning problem. Instead of manually parameterizing complex communication behaviors, the GPT model automatically learns parameters such as sender activity patterns, recipient preferences, message timing distributions, and topic frequencies from historical data. The model represents these patterns through learned embeddings and probability distributions, making the system adaptable to different networks without manual parameter tuning
Solution Approach 2:
The GPT model performs self-service by automatically generating realistic communication patterns without requiring manual configuration. The model independently learns from historical data and generates plausible sender messages, recipient selections, and timing patterns on its own. This self-service capability eliminates the need for operators to manually parameterize complex traffic patterns while maintaining high realism
Data Source
AI summary
This disclosure relates to a method for generating simulated communication data. A processor trains a model on historical communication data. The model comprises a probability distribution to model time, sender, and recipients and a parameter vector that jointly encodes information from the input event sequence of time value, the sender and the recipients. The probability distribution is based on the parameter vector. The processor generates a collection of simulated communication messages by sampling from the probability distribution to determine a time value, a sender, and recipients of the simulated communication message, wherein the recipients are dependent on the sender of the simulated message. The processor generates a simulated natural language text for the message, which is part of a simulated conversation between the sender and the recipients.