A new approach of network simulation for data generation in evaluating security products

Une nouvelle approche de simulation réseau pour la génération de données dans l'évaluation de produits de sécurité

Pierre-Marie Bajan (1, 2, 3, 4) , Hervé Debar (2, 3, 4) , Christophe Kiennert (2, 3, 4)

1 IRT SystemX
2 TSP - RST - Département Réseaux et Services de Télécommunications
3 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité
4 CNRS - Centre National de la Recherche Scientifique

Evaluating a security product requires the ability to conduct tests to assert that the product reacts as expected, both in terms of scalability and semantics. However, the production of evaluation data at a large scale with a high semantic is very costly with current methods. Load tests are semantically poor and semantic tests require a testbed environment to be deployed at a large scale. Evaluation data from real world activity need to be anonymized and a compromise must be made between the request of the evaluator and the interest of the real world organization. Moreover, to evaluate the full scope of a security product, the evaluator needs multiple test methods. In this paper, we describe a new methodology to produce evaluation data with a customizable level of realism and the possibility to be deployed at a large scale with lower resource requirements for a network support than a testbed environment. Our prototype relies on this method to generate realistic activity for up to 250 simulated users interacting with a real-world webmail server.

Mots clés: Simulation; Cybersecurity; Evaluation

Domaines: Modélisation et simulation; Réseaux et télécommunications [cs.NI]

Pierre-Marie Bajan, Hervé Debar, Christophe Kiennert. A new approach of network simulation for data generation in evaluating security products. ICIMP 2018: 13th International Conference on Internet Monitoring and Protection, Jul 2018, Barcelone, Spain. pp.35-41. ⟨hal-01901017⟩