Methodology for Automating Attacking Agents in Cyber Range Training Platforms

Abstract

The world faces cyberattacks daily and the targets of these attacks are often critical infrastructure, including the healthcare sector. In addition, more than half of cybersecurity professionals lack the necessary knowledge to deploy the relevant countermeasures to these attacks. In this regard, there is no doubt that education and training in cybersecurity are essential to defend technological assets. That is why, in this context, it is easy to understand that Cyber Ranges play a crucial role since these tools provide the user with a hyper-realistic experience for quality training. Thanks to attack simulators, commonly Advanced Persistent Threats (APT) generators, those realistic defensive cyberexercises can be performed. To implement these components, a behavioral matrix is needed, marking the different stages used by a cybersecurity expert during an attack, e.g. reconnaissance, explotation, data exfiltration, etc. Since bringing the current methodologies to a hyper-realistic production environment is an inordinate challenge, a novel matrix will be designed from simulation environments for training. This new methodology will compact dependent phases and simplify similar stages to automatically. Furthermore, the contribution contains a logic that increases the reality of the attacks. Finally, a proof of concept is made to evaluate the purposes the contribution purses.