Generating Realistic Environments for Cyber Operations Development, Testing and Training

Training effective cyber operatives requires realistic network environments that incorporate the structural and social complexities representative of the real world. Network traffic generators facilitate repeatable experiments for the development, training and testing of cyber operations. However, current network traffic generators, ranging from simple load testers to complex frameworks, fail to capture the realism inherent in actual environments. In order to improve the realism of network traffic generated by these systems, it is necessary to quantitatively measure the level of realism in generated traffic with respect to the environment being mimicked. We categorize realism measures into statistical, content, and behavioral measurements, and propose various metrics that can be applied at each level to indicate how effectively the generated traffic mimics the real world.