Information operations support system, method, and computer program product
A system, method and computer program product are provided for creation of a network training environment that simulates a large network as a training target and using simulation and virtual network technologies together with actual network resources to teach computer network exploitation and computer network attack techniques in training exercises for persons responsible for safeguarding networks and for probing and attacking others' networks. The system, method, and computer program product further support integration of real hosts for more realistic exercises.
1. A method comprising:
creating a target network comprising simulated network targets and actual network devices, each simulated network target being configured to simulate an actual network device;
permitting probing of the target network including both the simulated network targets and the actual network devices;
providing responses to the probing based on a fingerprint of a specified operating system to mimic the specified operating system responses to the probing, the fingerprint obtained using reverse engineered scanning software code;
permitting development of counterattack techniques by a user communicatively coupled to the target network via a computing device;
permitting development of network defense techniques; and
providing functionality to replay a teaching exercise allowing iterative development of counterattack and defense techniques.
2. The method of claim 1 wherein configuring the simulated network targets comprises defining responses from the simulated network targets to be appropriate for a respective operating system.
3. The method of claim 1 wherein creating the target network comprises defining latency via virtual connections between the simulated network targets and the actual network devices.
4. The method of claim 1 wherein creating the target networks comprises dragging and dropping an icon representative of a simulated network target onto a network map.
5. The method of claim 1 wherein probing of the target network comprises permitting use of forensic tools.
6. The method of claim 1 wherein creating the target network comprises performing autodiscovery of actual network devices attached to the target network.
7. The method of claim 2 , wherein defining responses comprising using a database of scanning source code to produce an appropriate response of a simulated network target in response to a probe.
8. A system comprising:
a network simulator configured to simulate a target network comprising simulated network targets and actual network devices, each simulated network target being configured to simulate an actual network device, wherein simulating an actual device includes providing responses to probing based on a fingerprint of a specified operating system to mimic the specified operating system responses to the probing, the fingerprint obtained using reverse engineered scanning software code; and
at least one workstation in communication with the network simulator and configured to probe the target network including both the simulated network targets and the actual network devices, wherein the workstation is configured to permit development of counterattack techniques by a user of the workstation, and wherein the workstation is configured to permit development of network defense techniques, the workstation being further configured to provide functionality to replay a teaching exercise allowing iterative development of counterattack and defense techniques.
9. The system of claim 8 further comprising an instructor workstation in communication with the network simulator and configured to monitor probing of the target network.
10. The system of claim 8 wherein the network simulator comprises a network simulation engine, a device simulation engine configured to perform pseudo-services, pseudo-routing, and fingerprinting, an actual device management module configured to perform configuration verification and actual-device and simulation-device integration, and an intrusion detection system.
11. The system of claim 10 wherein the network simulator further comprises a packet logging module.
12. The system of claim 8 , wherein the network simulator is further configured to simulate network targets using a database of scanning source code to produce an appropriate response of a simulated network target in response to a probe.
13. A computer program product comprising a computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising:
a first executable portion for creating a target network comprising simulated network targets and actual network devices, each simulated network target being configured to simulate an actual network device;
a second executable portion for permitting probing of the target network including both the simulated network targets and the actual network devices;
a third executable portion for permitting development of counterattack techniques by a user communicatively coupled to the target network via a computing device;
a fourth executable portion for permitting development of network defense techniques by a user communicatively coupled to the target network via a computing device; and
a fifth executable portion providing responses to the probing based on a fingerprint of a specified operating system to mimic the specified operating system responses to the probing, the fingerprint obtained using reverse engineered scanning software code;
wherein the first executable portion is further configured to provide functionality to replay a teaching exercise allowing iterative development of counterattack and defense techniques.
14. The computer program product of claim 13 , wherein the first executable portion is further configured to define responses from the simulated network targets to be appropriate for a respective operating system.
15. The computer program product of claim 13 wherein the first executable portion is further configured to define latency via virtual connections between the simulated network targets and the actual network devices.
16. The computer program product of claim 13 wherein the first executable portion is further configured to drag and drop an icon representative of a simulated network target onto a network map.
17. The computer program product of claim 13 wherein the second executable portion is further configured to permit use of forensic tools.
18. The computer program product of claim 13 wherein the first executable portion is further configured to perform autodiscovery of actual network devices attached to the target network.
19. The computer program product of claim 14 , wherein the first executable portion is further configured to use a database of scanning source code to produce an appropriate response of a simulated network target in response to a probe.