Network stimulation engine
Methods, devices, and systems are disclosed for simulating a large, realistic computer network. Virtual actors statistically emulate the behaviors of humans using networked devices or responses and automatic functions of networked equipment, and their stochastic actions are queued in buffer pools by a behavioral engine. An abstract machine engine creates the minimal interfaces needed for each actor, and the interfaces then communicate persistently over a network with each other and real and virtual network resources to form realistic network traffic. The network can respond to outside stimuli, such as a network mapping application, by responding with false views of the network in order to spoof hackers, and the actors can respond by altering a software defined network upon which they operate.
1. A method, comprising:
receiving, by a stimulation device on a network, a model for a physical computer, wherein the model is associated with empirical data describing one or more actions executed by the physical computer when the physical computer is experiencing average use, wherein an action is associated with activity on the network, and wherein the empirical data includes a time frame in which each action occurred and how frequently the action occurred within the time frame;
generating, by the stimulation device, an apparent network for the network, wherein generating the apparent network includes using the empirical data and a virtualized workstation, wherein a virtualized workstation is a simulated network device represented by a Media Access Control (MAC) address and Internet Protocol (IP) address, and wherein a network interface of the stimulation device hosts the MAC and IP address;
using, by the stimulation device, a schedule to randomly select an action to execute on the apparent network, wherein the action simulates network activity from the virtualized workstation;
generating, by the stimulation device, one or more packets for the action selected from the schedule, wherein generating the one or more packets includes assigning the MAC address and the IP address associated with the virtualized workstation as a source address of the one or more packets; and
transmitting, by the stimulation device, the one or more packets associated with the action selected from the schedule, wherein, when the one or more packets are transmitted on the network, the one or more packets simulate network activity on the apparent network, and wherein the apparent network makes one or more physical computer on the network indistinguishable from one or more simulated network devices thereby reducing an ability of a hacker to affect an operation of the network.
2. The method of claim 1 , further comprising:
selecting an IP address from a list of IP addresses, wherein the list of IP addresses includes IP addresses for one or more physical computers and IP addresses for one or more other virtualized workstations; and
assigning the selected IP address to the one or more packets.
3. The method of claim 1 , further comprising:
randomly selecting an IP address from a list of IP addresses, wherein the list of IP addresses includes IP addresses for one or more physical computers and IP addresses for one or more other virtualized workstation; and
assigning the randomly selected IP address to the one or more packets.
4. The method of claim 1 , further comprising:
assigning a destination MAC address and a destination IP address to the one or more packets, wherein the destination MAC address and the destination IP address are associated with another virtualized workstation, wherein, when the one or more packets are on the network, the one or more packets simulate an active network connection on the apparent network between the virtualized workstation and the other virtualized workstation.
5. The method of claim 1 , wherein time frames include one or more of a time of day or a day of the week.
6. The method of claim 1 , wherein the model includes empirical data aggregated from information collected from multiple physical computers.
7. The method of claim 1 , further comprising:
initiating the virtualized workstation; and
associating the virtualized workstation with the network interface of the stimulation device.
8. The method of claim 1 , further comprising:
determining a particular action that can be executed by the virtualized workstation at a specific point in time, wherein determining the particular action includes using the empirical data associated with the model.
9. The method of claim 8 , wherein determining the particular action that can be executed by the virtualized workstation at the specific point in time includes:
using the empirical data associated with the model to determine a list of one or more actions executed by the physical computer at the specific point in time; and
selecting the particular action from the list of one or more actions.
10. The method of claim 1 , further comprising:
determining a likelihood that a particular action will occur at a specific point in time, wherein determining the likelihood includes using the empirical data associated with the model.
11. The method of claim 10 , wherein determining the likelihood that the particular action will occur at the specific point in time includes:
using the empirical data associated with the model to determine how frequently the particular action was executed by the physical computer at the specific point in time; and
using the frequency to determine the likelihood.
12. The method of claim 1 , further comprising:
adding a particular action and a likelihood that the particular action will occur to the schedule, wherein the particular action and the likelihood the particular action will occur is added to the schedule at a specific point in time.
13. The method of claim 1 , further comprising:
using the schedule to select the action for a current point in time when the current point in time is a specific point in time.
14. The method of claim 1 , wherein a virtualized workstation is an abstract machine.
15. A network stimulation device, comprising:
a network interface;
one or more processors; and
a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
receiving a model for a physical computer, wherein the model is associated with empirical data describing one or more actions executed by the physical computer when the physical computer is experiencing average use, wherein an action is associated with activity on the network, and wherein the empirical data includes a time frame in which each action occurred and how frequently the action occurred within the time frame;
generating an apparent network for the network, wherein generating the apparent network includes using the empirical data and a virtualized workstation, wherein a virtualized workstation is a simulated network device represented by a Media Access (MAC) address and an Internet Protocol (IP) address, and wherein a network interface of the stimulation device hosts the MAC and IP address;
using a schedule to randomly select an action to execute on the apparent network, wherein the action simulates network activity from the virtualized workstation;
generating one or more packets for the action selected from the schedule, wherein generating the one or more packets includes assigning the MAC address and the IP address associated with the virtualized workstation as a source address of the one or more packets; and
transmitting the one or more packets associated with the action selected from the schedule, wherein, when the one or more packets are transmitted on the network, the one or more packets simulate network activity on the apparent network, and wherein the apparent network makes one or more physical computers on the network indistinguishable from one or more simulated network devices thereby reducing an ability of a hacker to affect an operation of the network.
16. The network stimulation device of claim 15 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
selecting an IP address from a list of IP addresses, wherein the list of IP addresses that includes IP addresses for one or more physical computers and IP addresses for one or more other virtual workstations; and
assigning the selected IP address to the one or more packets.
17. The network stimulation device of claim 15 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
randomly selecting an IP address from a list of IP addresses, wherein the list of IP addresses includes IP addresses for one or more physical computers and IP addresses for one or more other virtualized workstations; and
assigning the randomly selected IP address to the one or more packets.
18. The network stimulation device of claim 15 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
assigning a destination MAC address and destination IP address to the one or more packets, wherein the destination MAC address and the destination IP address are associated with another virtual workstation, and wherein, when the one or more packets are on the network, the one or more packets simulate an active network connection on the apparent network between the virtual workstation and the other virtual workstation.
19. The network stimulation device of claim 15 , wherein time frames include one or more of a time of day or a day of the week.
20. The network stimulation device of claim 15 , wherein the model includes empirical data aggregated from information collected from multiple physical computers.
21. The network stimulation device of claim 15 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
initiating the virtual workstation; and
associating the virtual workstation with the network interface of the network stimulation device.
22. The network stimulation device of claim 15 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
determining a particular action that can be executed by the virtualized workstation at a specific point in time, wherein determining the particular action includes using the empirical data associated with the model.
23. The network stimulation device of claim 22 , wherein the instructions for determining the particular action that can be executed by the virtualized workstation at the specific point in time include instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
using the empirical data associated with the model to determine a list of one or more actions executed by the physical computer at the specific point in time; and
selecting the particular action from the list of one or more actions.
24. The network stimulation device of claim 15 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
determining a likelihood that a particular action will occur at a specific point in time, wherein determining the likelihood includes using the empirical data associated with the model.
25. The network stimulation device of claim 24 , wherein the instructions for determining the likelihood that the determined action will occur at the specific point in time include instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
using the empirical data associated with the model to determine how frequently the particular action was executed by the physical computer at the specific point in time; and
using the frequency to determine the likelihood.
26. The network stimulation device of claim 15 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
adding a particular action and a likelihood that the particular action will occur to the schedule, wherein the particular action and the likelihood the particular action will occur is added to the schedule at a specific point in time.
27. The network stimulation device of claim 15 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
using the schedule to select the action for a current point in time when the current point in time is a specific point in time.
28. The network stimulation device of claim 15 , wherein a virtualized workstation is an abstract machine.
29. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by one or more processors, cause the one or more processors to:
receive a model for a physical computer, wherein the model is associated with empirical data describing one or more actions executed by the physical computer when the physical computer is experiencing average use, wherein an action is associated with activity on the network, and wherein the empirical data includes a time frame in which each action occurred and how frequently the action occurred within the time frame;
generate an apparent network for the network, wherein generating the apparent network includes using the empirical data and a virtualized workstation, wherein a virtualized workstation is a simulated network device represented by a Media Access Control (MAC) address and Internet Protocol (IP) address, and wherein a network interface hosts the MAC and IP address;
use a schedule to randomly select an action to execute on the apparent network, wherein the action simulates network activity from the virtualized workstation;
generate one or more packets for the action selected from the schedule, wherein generating the one or more packets includes assigning the MAC address and the IP address associated with the virtualized workstation as a source address of the one or more packets; and
transmit the one or more packets associated with the action selected from the schedule, wherein when the one or more packets are transmitted on the network, the one or more packets simulate network activity on the apparent network, and wherein the apparent network makes one or more physical computers on the network indistinguishable from one or more simulated network devices thereby reducing an ability of a hacker to affect an operation of the network.
30. The computer-program product of claim 29 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:
select an IP address from a list of IP addresses, wherein the list of IP addresses includes IP addresses for one or more physical computers and IP addresses for one or more other virtualized workstations; and
assign the selected IP address to the one or more packets.
31. The computer-program product of claim 29 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:
randomly select an IP address from a list of IP addresses, wherein the list of IP addresses includes IP addresses for one or more physical computers and IP addresses for one or more other virtualized workstation; and
assign the randomly selected IP address to the one or more packets.
32. The computer-program product of claim 29 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:
assign a destination MAC address and a destination IP address to the one or more packets, wherein the destination MAC address and the destination IP address are associated with another virtualized workstation, and wherein, when the one or more packets are on the network, the one or more packets simulate an active network connection on the apparent network between the virtualized workstation and the other virtualized workstation.
33. The computer-program product of claim 29 , wherein time frames include one or more of a time of day or a day of the week.
34. The computer-program product of claim 29 , wherein the model includes empirical data aggregated from information collected from multiple physical computers.
35. The computer-program product of claim 29 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:
initiate the virtualized workstation; and
associate the virtualized workstation with the network interface.
36. The computer-program product of claim 29 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to:
determine a particular action that can be executed by the virtualized workstation at a specific point in time, wherein determining the particular action includes using the empirical data associated with the model.
37. The computer-program product of claim 36 , wherein the instructions for determining the particular action that can be executed by the virtualized workstation at the specific point in time include instructions that, when executed by the one or more processors, cause the one or more processors to:
use the empirical data associated with the model to determine a list of one or more actions executed by the physical computer at the specific point in time; and
select the particular action from the list of one or more actions.
38. The computer-program product of claim 29 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to:
determine a likelihood that a particular action will occur at a specific point in time, wherein determining the likelihood includes using the empirical data associated with the model.
39. The computer-program product of claim 38 , wherein the instructions for determining the likelihood that the determined action will occur at the specific point in time include instructions that, when executed by the one or more processors, cause the one or more processors to:
use the empirical data associated with the model to determine how frequently the particular action was executed by the physical computer at the specific point in time; and
use the frequency to determine the likelihood.
40. The computer-program product of claim 29 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to:
add a particular action and a likelihood that the particular action will occur to the schedule, wherein the particular action and the likelihood the particular action will occur is added to the schedule at a specific point in time.
41. The computer-program product of claim 29 , wherein, wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to:
use the schedule to select the action for a current point in time when the current point in time is a specific point in time.
42. The computer-program product of claim 29 , wherein a virtualized workstation is an abstract machine.