Modeling Network Traffic Generators for Cyber Ranges: A Systematic Literature Review

doi:10.21203/rs.3.rs-4041751/v1

Cyber ranges have evolved into indispensable environments for training personnel in the field of cyber defense. A critical aspect of enhancing the authenticity of these simulations involves the use of traffic generators, which accurately replicate real network traffic patterns. This article delves into the paramount role played by traffic generators within cyber ranges, highlighting their pivotal contribution to equipping personnel with the skills needed to respond adeptly to cyber threats. To address the modeling and validation of traffic generators comprehensively, it is essential to consider diverse approaches in cyber range training. To shed light on this subject, this review adopts a modified Scopus-based search methodology, providing in-depth insights into the methodologies and validation methods associated with traffic generator modeling and validation. The analysis concluded that the traffic generators used for computer network security training purposes can be broadly categorized into three main methodologies: model-based, trace-based, and hybrid approaches. Each of these methodologies has its own set of applications, limitations, and advantages. These factors have a direct influence on the validation parameters associated with these methodologies.

Cyber Range

Traffic Generator

Malware Traffic

Model-based

Trace-based

Hybrid Model

In response to escalating global cybercrime threats, the training of specialized and non-specialized personnel in cyber defense has become essential. To facilitate this training, a cyber range (CR) plays a pivotal role in creating virtualized networks. Within these virtual environments, traffic generators assume a crucial function because they simulate the behavior of network users. By emulating real-world network traffic patterns, these generators enhance the training experience, allowing participants to develop practical skills and grasp the consequences of their actions in a controlled and secure setting [1].

The synthetic network traffic generator (TG) software is a specialized program designed to replicate network behavior within predetermined parameters. Its primary focus lies in specific protocols of interest, making it a crucial tool for constructing the CR environment.

TG plays a pivotal role in creating realistic scenarios within a CR by generating simulated network traffic. This simulation emulates the behavior of actual users, applications, and devices, resulting in the creation of authentic training scenarios. Additionally, TG can be employed to assess the performance and resilience of network infrastructure and security tools under varying traffic loads and attack simulations.

Furthermore, TG can be utilized to test specific network protocols and evaluate their responses to different traffic patterns, aiding in the identification of vulnerabilities and potential security gaps.

The TG used for network security aims to replicate malicious traffic patterns that have the potential to compromise the integrity, confidentiality, or availability of network resources. On the other hand, traffic generators designed for workload or maximum throughput aim to recreate legitimate traffic patterns that can stress network capacity or test system performance.

Since the TG is tailored to meet specific needs and scenarios, it introduces a wide range of modeling options and validation parameters. This unique adaptability prompted the undertaking of this systematic review, which seeks to identify the latest and most prevalent modeling techniques used in traffic generators and their corresponding validation processes. As a result, this review contributes to providing guidance for the planning and development of TGs intended for use in cyber ranges.

This review is primarily centered on simulations within the realm of network security, delving into specific aspects pertinent to this field. However, computer security constitutes a broader spectrum of considerations. Therefore, diverse approaches to traffic generation have become necessary when addressing the multifaceted aspects of computer security.

This paper is structured as follows: Section 2 - Related works provide previous reviews, their focuses and the limitations that motivated this systematic review; Section 3 presents the research questions that the review aims to answer; Section 4 - Methodology offers a detailed description of the article selection process; Section 5 - Results conducts an analysis considering addressing the research questions; Section 6 Discussion - presents the observations drawn from the results and the contributions outlined; Section 7 - highlights the threats to the validation of the review and the strategies adopted to mitigate or reduce them; and finally, Section 8 - Conclusion presents concluding remarks and outlines future directions.

A comprehensive literature review was conducted to explore the current state of the art and identify relevant studies focusing on the modeling and validation of network traffic generators.

While this review revealed three primary works that offer valuable insights into network traffic generation, it also revealed certain limitations within these studies. This discovery has highlighted the necessity for a new and more in-depth approach in the form of a systematic literature review (SLR). The objective of this SLR is to enhance our understanding of traffic generator methodologies and validation techniques.

One study [2] concentrated on traffic generation using generative adversarial network (GAN), setting aside other methodologies in the process. Similarly, [3] provided a broad analysis of machine learning (ML) and deep learning (DL) traffic generation. However, akin to the first study, this study focused on a specific methodology, neglecting the exploration of alternative approaches. [4] offered a comprehensive classification of various traffic generation methods. Nevertheless, due to its extensive scope, the review falls short in delving into a detailed analysis of the methodologies it encompasses.

To achieve the objective of understanding the methodologies and their evaluation, the following research questions were formulated:

• Which traffic generation methodologies have been most commonly employed in the analyzed articles, and what are the primary advantages associated with their implementation?

• What evaluation parameters have been utilized to validate traffic generators in the reviewed literature?

A modified version of the Scopus-based search methodology was used to conduct the systematic literature review, which is based on a search string defined using the PICO criteria [5]. Additionally, a snowballing approach is implemented, that incorporates a hybrid methodology [5].

Table 1 PICO Criteria description and search string

Criteria	Description	Logical string
Population	The publications that focus on “network traffic generators".	(“network traffic simulation" OR “network traffic generation")
Intervention	Specifically, those applied to the “cyber range" environment.	(“cyber range" OR “cyberdefense" OR “cyber training")
Comparison	In this paper, a specific comparison is not applicable.
Outcome	articles that address the “analysis of methodologies used in generating traffic".	(“model" OR “ Modeling")

The article selection process was carried out meticulously in three distinct stages of filtering, with exclusion criteria (Table 2) applied at each stage. In the first stage, were evaluated to determine their suitability against the inclusion criteria, with a focus on relevant research areas.

In the second stage, the introductions and conclusions of articles that passed through the initial selection phase were analyzed in greater detail, aiming to identify studies that delved more deeply into network traffic generation and its methodologies.

In the third stage, the remaining articles underwent a comprehensive review, with each article being meticulously examined to ensure it met the criteria of quality, relevance, and depth of content.

Table 2 Exclude criteria description.

Code	Description
EC1	Exclude articles that are not in the English language.
EC2	Exclude articles that are not published in vehicles that undergo peer review.
EC3	Unable to access, except with payment, even after intense searches and contact with the authors.
EC4	Articles whose network traffic generation CR research is not the main subject.
EC5	Articles published before 2000.
EC6	Articles that are not primary sources

Furthermore, to mitigate the possibility of bias, enhance research validation, and ensure that no relevant studies were overlooked, a snowballing technique was applied. This involved both searching for articles that cited the selected studies (forward snowballing) and analyzing the bibliographic references of these articles to identify studies that may have been previously omitted (backward snowballing).

This complementary approach allowed for the expansion of the research, ensuring that the article selection was as comprehensive as possible. The quantitative outcome of this process can be observed in Table 3.

After the completion of these selection and research expansion stages, the outcome was the construction of a corpus consisting of 57 articles deemed relevant and meeting the pre-established criteria. These articles formed the corpus from which the results of the literature review were derived, and subsequent analyses were conducted.

Table 3 Number of analyzed articles.

Phase	Return	Efficiency
Start set	10 articles
F1	9 articles
F2	9 articles
F3	9 articles	90%
Foward Snowballing 1	44 articles
F1	11 articles
F2	3 articles
F3	3 articles	6.82%
Backward Snowballing 1	315 articles
F1	45 articles
F2	17 articles
F3	15 articles	3.81%
Foward Snowballing 2	1178 articles
F1	8 articles
F2	1 article
F3	26 articles	2.12%
Backward Snowballing 2	423 articles
F1	71 articles
F2	23 articles
F3	7 articles	1.65%
total selected	57 articles

This comprehensive approach to selection and expansion ensured that the research addressed a wide variety of sources and information, providing a solid foundation for subsequent analysis and conclusions.

Out of the total of 57 articles, twelve were selected for this study after passing through the filters of our systematic literature review. The calculation of the h-index was based on the impact of citations of the articles within this set of 57, as illustrated in Figure 1. This approach allowed us to identify and prioritize articles that demonstrated a notable level of influence and recognition in the research field, ensuring that our analysis focused on the most impactful contributions. Table 4 presents the citation matrix for these articles

Table 4 Citation Matrix

Document	Year	< 2019	2019	2020	2021	2022	2023	subtotal	total
[6]	2004	135	1	4	7	3	0	15	150
[7]	2019	0	6	11	28	35	15	95	95
[8]	2009	57	2	4	8	6	1	21	78
[9]	2002	54	3	3	3	3	2	14	68
[10]	2004	49	5	0	0	2	0	7	56
[11]	2006	35	1	5	2	3	0	11	46
[12]	2019	0	0	5	11	18	10	44	44
[13]	2003	17	1	0	1	1	1	4	21
[14]	2020	0	0	0	4	10	5	19	19
[15]	2012	10	1	1	1	4	1	8	18
[16]	2014	6	1	3	2	2	1	9	1
[17]	2008	10	0	2	0	1	1	4	14

5.1 Traffic Generation Methodologies

Based on the analysis of the articles, there are three main approaches for generating network traffic: Model-Based, Trace-Based, and Hybrid, which implement both previous approaches. The classification of the selected articles is shown in Table 5.

Model-based generation involves the use of statistical, stochastic, or learning models to create synthetic traffic based on parameters and distributions. Notable examples of model-based traffic generators include [6, 7, 12].

Trace-based generation involves the use of packet or connection traces to capture and reproduce real traffic based on events and timers. Significant examples of trace-based traffic generators include [10, 13, 15].

Table 5 Modeling

Article	Model	Trace
[9]		🗸
[13]		🗸
[6]	🗸
[10]		🗸
[11]	🗸
[17]	🗸
[8]	🗸
[15]		🗸
[16]	🗸
[12]	🗸
[7]	🗸
[14]	🗸

Some approaches were specifically developed for a CR; therefore, they have components implemented in hardware, such as the case of [9], who conducted their research on the Lincoln Adaptable Real-time Information Assurance Testbed (LARIAT), a physical computing platform developed by the Massachusetts Institute of Technology (MIT). Moreover, [17] directed its efforts toward optimizing network load generation by employing a dedicated processor. Table 6 presents the implementation in hardware or software of the GT.

Table 6 Hardware or Software Implementation

Article	Hardware	Software
[9]	🗸
[13]		🗸
[6]		🗸
[10]		🗸
[11]		🗸
[17]	🗸
[8]		🗸
[15]		🗸
[16]		🗸
[12]		🗸
[7]		🗸
[14]		🗸

Each proposed model has distinct advantages and disadvantages in its application. In general terms, GTs are developed to address a particular context and specialize in a specific task. The advantages of these models are detailed in Table 7, while the disadvantages are addressed in Table 8.

Table 7: Advantages of each modeling

Article	Advantages
[9]	Automatic, quantitative, adaptable, supports the evaluation of intrusion detection systems and other information assurance technologies
[13]	Accurate, high-performance, low-cost, uses open-source hardware and software
[6]	Automatic, realistic, reproducible
[10]	Faithful, accurate, able to reproduce traffic under different network conditions
[11]	The article continues its modeling development in the author's 2009 publication
[17]	Able to generate network traffic with high rate and flexibility, using a programmable NP
[8]	Simple, realistic, responsive, able to vary user, application, and network characteristics
[15]	Able to reproduce real WLAN traffic in an emulated environment, with different channel conditions and mobility
[16]	Realistic representation of spatial and temporal characteristics of real traffic, flexibility to scale traffic intensity, independence from network topology
[12]	Able to generate synthetic network packets with attack characteristics, using context information
[7]	Able to learn the flow data distribution without prior knowledge, flexible, scalable
[14]	Able to learn flow data distribution without prior knowledge, flexible, scalable; Able to generate synthetic network traffic for Internet of Things (IoT) devices, using different GNN architectures

Table 8: GT Modelings - Disadvantages

Article	Disadvantages
[9]	Requires manual configuration of scenarios, does not generate stochastic traffic, limited to known attacks
[13]	Requires access to packet traces, does not generate new traffic, does not model UDP or multicast traffic
[6]	Limited to TCP traffic scenarios, does not consider temporal dependencies between flows
[10]	Requires access to packet traces, does not generate new traffic, does not model UDP or multicast traffic
[11]	The article continues its modeling development in the author's 2009 publication
[17]	Requires a specific NP, does not reproduce real traffic, does not consider temporal dependencies between packets
[8]	Does not consider dependencies between different observation points, does not model UDP or multicast traffic, requires large storage space
[15]	Requires access to WLAN packet traces, does not generate new traffic, limited to WLAN traffic
[16]	Requires the use of real traffic data for training, can be computationally intensive for large-scale networks
[12]	Requires a large amount of labeled data, difficult to train and evaluate, does not consider temporal dependencies between packets
[7]	Sensitive to the quality of input data, requires preprocessing to handle categorical attributes, difficult to train and evaluate
[14]	Sensitive to the quality of input data, requires preprocessing to handle categorical attributes, difficult to train and evaluate; Requires a large amount of IoT data, difficult to train and evaluate, does not consider temporal dependencies between packets

5.2 Validation Parameters

Multiple validation parameters were employed to assess the performance of traffic generation. However, there are cases where the articles do not explicitly specify the application of GT, but this can be inferred based on the characteristics of the generated traffic. The most striking characteristics that frame each tool in its application are described in Table 9.

These multiple validation parameters ensure a comprehensive evaluation of traffic generation techniques and their suitability for different network contexts. A summary of these parameters can be found in Table 10.

The parameters used in the validation of different application areas, cover various essential dimensions such as:

Table 9 Application Characteristics

Article	Performance	Realism	Responsiveness	Diversity	Security	Scalability
[9]					🗸
[13]					🗸
[6]	🗸	🗸		🗸
[10]					🗸
[11]	🗸	🗸	🗸
[17]	🗸	🗸				🗸
[8]	🗸	🗸	🗸
[15]	🗸	🗸		🗸
[16]		🗸				🗸
[12]					🗸
[7]	🗸				🗸
[14]	🗸	🗸		🗸

• Parameters related to applications aiming for performance evaluate the effectiveness of the generated traffic, considering factors such as transmission rate, latency, and packet loss;

• The validation parameters of GTs seeking realism measure how much the generated traffic replicates real-world scenarios, considering aspects such as similarity, correlation, and dependency;

• Diversification parameters focus on variety within the generated traffic, consider ing factors such as diversity, heterogeneity, and complexity;

• Responsiveness parameters assess the ability of a TG to adapt to constantly changing network conditions and include attributes such as adaptability, reactivity, and feedback mechanisms;

• The security parameters assess the ability of the TG to reproduce certain types of attacks, focusing on the type of attack to be simulated, and thus on application protocols such as HTTP, SMTP, PHP, and FTP;

• The scalability parameters assess the ability of a TG to handle variable workloads, including factors such as capacity, flexibility, and extensibility.

The articles presented in Table 5 demonstrate various methodologies for generating and replicating network traffic, each with unique approaches and applications.

6.1 Model-Based Approach

This approach offers flexibility, allowing the generation of traffic that accurately represents a wide variety of scenarios and conditions, encompassing various network topologies, protocols, and applications. Model-based traffic generators serve various purposes such as:

Table 10 Validation Parameters

[9]

🗸

[13]

🗸

[6]

🗸

[10]

🗸

[11]

🗸

[17]

🗸

[8]

🗸

[15]

🗸

[16]

🗸

[12]

🗸

[7]

🗸

[14]

🗸

• Performance testing: Model-based traffic generators are instrumental in simulating a large number of users accessing a website or web service, facilitating performance evaluation under heavy load.

• Security analysis: These generators can produce realistic attack traffic, which is valuable for assessing the security of network systems and applications.

• Network analysis: Model-based traffic generators allow the creation of different traffic scenarios to evaluate network behavior and efficiency.

• Network simulation: They play a key role in generating realistic traffic to simulate networks and assess their performance under varied conditions.

One of the main advantages of model-based traffic generation is its ability to generate traffic that accurately emulates real-world conditions without the need to capture and replay real traffic traces. This characteristic is crucial in scenarios where capturing real-world traffic may be impractical or infeasible, especially for emerging or novel network technologies.

However, model-based traffic generation also presents challenges. Creating models that faithfully represent real-world traffic patterns can be complex. Additionally, model-based traffic generators can be computationally demanding.

Harpoon [6] is a software-based approach that utilizes statistical models to generate realistic network traffic at the IP flow level. It self-configures by extracting parameters from Netflow logs or packet traces. Its components, such as the flow generator, packet generator, load generator, and address generator, operate in a software environment. Future work includes scalability evaluation and integration into simulation environments.

Swing [8] is a software-based approach that uses machine learning to create adaptive network traffic. It employs software components like an event generator, propagation model, and response model, which are trained using real network traffic data. Future work for Swing involves improving model accuracy and evaluating its performance across different network sizes.

The work by [14] proposes a novel approach to generate realistic Internet of Things (IoT) network traffic using generative deep learning (GDL). The method utilizes a combination of an autoencoder and a generative adversarial network (GAN) to effectively capture and reproduce statistical properties of IoT network traffic. Future work includes enhancing traffic accuracy, extending the method to support different types of IoT traffic, and developing real-time traffic generation.

BRUNO [17] is a hardware-based approach that generates high-performance network traffic using a dedicated network processor. The traffic generator and network processor are hardware components that work together to generate and send network packets. Future work for BRUNO includes exploring different types of networks.

[16] proposes an algorithm that clusters hosts into clusters based on traffic statistics extracted from real data. This approach, grounded in spatial and temporal patterns, generates more realistic background traffic in network simulations. Future work aims to improve computational efficiency and explore applications in different types of networks.

PAC-GAN [12] is a software-based approach that combines Generative Adversarial Network (GAN) with Convolutional Neural Network (CNN) to generate realistic network traffic. The generator and discriminator components are implemented in the software. Future work includes application to different types of traffic and adaptation to different network types.

6.2 Trace-Based Approach

Trace-based traffic generation offers a highly accurate approach as it reproduces real traffic. However, it is less flexible as it can only replicate traffic closely resembling the captured trace. Trace-based traffic generators find utility in various applications, including:

• Performance testing: They replicate real-world traffic traces to evaluate the performance of network systems and applications under authentic conditions.

• Security analysis: These generators replicate attack traffic traces to assess the security of network systems and applications against real attacks.

• Network analysis: They recreate real-world traffic traces to study network behavior and efficiency under realistic conditions.

• Network simulation: They replicate real-world traffic traces to simulate networks and assess their performance under different conditions.

One of the main advantages of trace-based traffic generation is its ability to generate traffic closely resembling real-world conditions, making it particularly valuable when testing network systems and applications in highly realistic scenarios.

However, trace-based traffic generation also presents challenges. Acquiring representative real-world traffic traces can be a complex task. Additionally, the computational demands of trace-based traffic generators, especially when reproducing extensive traffic traces, can be substantial.

Event-Automaton synchronized replay (EAR) [15] is supported by a client-server architecture composed of three main components: trace collector, trace replay, and environment emulator. However, there are limitations that need to be addressed, such as challenges related to handling packet loss or corruption, emulating diverse wireless effects or environments, and reproducing traffic with variable WLAN implementations or parameters.

Monkey [10] is a software-based tool for TCP tracking and replay, generating realistic network traffic. It utilizes software components including Monkey See and Monkey Do for data collection and replay. Monkey See collects TCP traffic data using a network sniffer, while Monkey Do accurately replays TCP traffic on a test network. Future work includes extending its application to other types of traffic and exploring usage in different types of networks.

LARIAT [9] is a software-based approach designed for information security applications. It replicates real-world network conditions with software components including physical nodes, a control system, a simulation system, and testing tools. The control system generates network traffic, and the simulation system replicates the real network environment. Future work includes performance improvement and exploration of broader applications.

TCPivo [13] is a high-performance packet replay engine-based software to replicate network events. It consists of software components including an event generator, propagation model, and response model. Future work includes improving accuracy, extending to other types of traffic, and adapting to different network types using network simulation techniques.

6.3 Hybrid Approaches

Traffic generators can adopt a hybrid approach that combines the flexibility of model-based generation and the accuracy of trace-based generation. This approach allows for the overall traffic pattern to be established using model-based generation, while specific details such as realistic packet sizes and timings can be introduced using trace-based generation.

For instance, a traffic generator may use the model-based approach to create a general traffic pattern and then use trace-based generation to fine-tune the generated traffic by adding details such as packet sizes and timings.

Regarding the systematic review, it is important to acknowledge the potential for bias in the selection and analysis of articles, a challenge inherent in any comprehensive literature review. However, it is crucial to emphasize that a rigorous methodology and strict inclusion criteria were meticulously employed to mitigate bias and ensure the reliability of the conclusions. Despite the possibility of inherent limitations, the systematic review process was executed with precision, grounding the findings and insights presented herein in the best available evidence.

This systematic review aimed to comprehensively explore and evaluate the state of the art in the methodology and validation of traffic generators. Its primary objective was to provide an exhaustive and impartial examination of the current landscape of traffic generation techniques and their respective validation methodologies. Through this comprehensive review, our goal was to contribute valuable insights and a well-informed perspective to the dynamic field of traffic generation, ultimately benefiting researchers, practitioners, and the broader scientific community.

This systematic review revealed a multitude of approaches for modeling network traffic generators, each of which is tailored to specific objectives, requirements, and limitations. These approaches encompass statistical analysis, machine learning, and scenario simulation techniques. They range from generating normal background traffic to simulating malicious or anomalous traffic and employ both flow and packet data, with variations in their data requirements.

Two primary methodologies for generating network traffic have emerged: model-based and trace-based traffic generation. Model-based generation offers greater flexibility but can pose challenges in accurately representing real-world traffic patterns. In contrast, trace-based generation provides higher accuracy but is less flexible and can be constrained by the availability of representative real-world traffic traces, aligning with researchers’ and engineers’ testing scenarios.

Among these two primary methodologies, arises the hybrid approach, which can allow for a balance between the advantages and disadvantages of model-based and trace-based methods.

Each approach possesses distinct merits and limitations, with the selection contingent upon the specific context and objectives of traffic generation. Thus, it becomes imperative to comprehend the unique characteristics, advantages, and constraints of each approach and to evaluate them based on pertinent criteria such as quality, accuracy, scalability, flexibility, and user-friendliness. Moreover, exploring novel approaches or synergizing existing approaches has the potential to enhance TG capabilities and address evolving requirements in modern network systems.

The choice of the optimal traffic generation methodology hinges upon the researcher’s or engineer’s specific requirements. For scenarios demanding highly realistic and representative traffic mirroring real-world conditions, trace-based generation is the preferred choice. Conversely, for scenarios necessitating diverse traffic patterns encompassing a broad spectrum of conditions, model-based generation serves as the more suitable option.

Moreover, the absence of standardized validation or certification procedures [18], calls for a continual exploration of diverse assessment methods tailored to the unique purposes of traffic generators. This flexibility allows researchers and engineers to adapt their evaluations to meet the evolving demands of modern network systems and, ultimately, advance the field of network traffic generation.

9.1 Ethical Approval

Not applicable.

9.2 Funding

No funding has been received.

Author Contribution

J.B. wrote the main manuscript text and prepared figures and tables. The other authors are advisors. All authors reviewed the manuscript.

9.3 Availability of data and materials

Not applicable.

Javali, C. & Revadigar, G. Network Web Traffic Generator for Cyber Range Exercises, 308–315 (2019). ISSN: 0742-1303.
Anande, T. J. & Leeson, M. S. Generative adversarial networks (gans): A survey on network traffic generation. International Journal of Machine Learning and Computing (2022). URL https://api.semanticscholar.org/CorpusID:253339791.
Kieweg, M., Bender, T. & Stiemerling, M. Bajpai, V., Haddadi, H. & Hohlfeld, O. (eds) Fantastic traffic models and where to find them - A literature review. (eds Bajpai, V., Haddadi, H. & Hohlfeld, O.) 5th Network Traffic Measurement and Analysis Conference, TMA 2021, Virtual Event, September 14-15, 2021 (IFIP, 2021). URL http://dl.ifip.org/db/conf/tma/tma2021/tma2021-paper5.pdf.
Adeleke, O. A., Bastin, N. & Gurkan, D. Network traffic generation: A survey and methodology. ACM Comput. Surv. 55 (2022). URL https://doi.org/10.1145/ 3488375.
Mour˜ao, E. et al. On the performance of hybrid search strategies for systematic literature reviews in software engineering. Information and Software Technol ogy 123, 106294 (2020). URL https://www.sciencedirect.com/science/article/ pii/S0950584920300446.
Sommers, J. & Barford, P. Self-configuring network traffic generation, IMC ’04, 68–81 (Association for Computing Machinery, New York, NY, USA, 2004). URL https://doi.org/10.1145/1028788.1028798.
Ring, M., Schl¨or, D., Landes, D. & Hotho, A. Flow-based network traf fic generation using generative adversarial networks. Computers Security 82, 156–172 (2019). URL https://www.sciencedirect.com/science/article/pii/ S0167404818308393.
Vishwanath, K. V. & Vahdat, A. Swing: Realistic and Responsive Network Traf fic Generation. IEEE/ACM Transactions on Networking 17, 712–725 (2009). Conference Name: IEEE/ACM Transactions on Networking.
Rossey, L. et al. LARIAT: Lincoln adaptable real-time information assurance testbed, Vol. 6, 6–6 (2002).
Cheng, Y.-C., Holzle, U., Cardwell, N., Savage, S. & Voelker, G. M. Monkey See, Monkey Do: A Tool for TCP Tracing and Replaying (2004).
Vishwanath, K. V. & Vahdat, A. Realistic and responsive network traffic gen eration. SIGCOMM Comput. Commun. Rev. 36, 111–122 (2006). URL https: //doi.org/10.1145/1151659.1159928.
Cheng, A. PAC-GAN: Packet Generation of Network Traffic using Generative Adversarial Networks, 0728–0734 (2019). ISSN: 2644-3163.
Feng, W.-c., Goel, A., Bezzaz, A., Feng, W.-c. & Walpole, J. TCPivo: a high-performance packet replay engine, MoMeTools ’03, 57–64 (Association for Computing Machinery, New York, NY, USA, 2003). URL https://dl.acm.org/ doi/10.1145/944773.944783.
Shahid, M. R., Blanc, G., Jmila, H., Zhang, Z. & Debar, H. Generative deep learning for internet of things network traffic generation, 70–79 (2020).
Ku, C.-Y., Lin, Y.-D., Lai, Y.-C., Li, P.-H. & Lin, K. C.-J. Real traffic replay over WLAN with environment emulation, 2406–2411 (2012). ISSN: 1558-2612.
Li, T. & Liu, J. Cluster-based spatiotemporal background traffic generation for network simulation (2014). URL https://www.scopus.com/inward/record. uri?eid=2-s2.0-84911484181&doi=10.1145%2f2667222&partnerID=40&md5= c4a4536e6d94b26cde16e3a555f17b19.
Antichi, G. et al. BRUNO: A high performance traffic generator for network processor, 526–533 (2008).
Patil, A. G., Surve, A. R., Gupta, A. K., Sharma, A. & Anmulwar, S. Survey of synthetic traffic generators, Vol. 1, 1–3 (2016).
Song, Y., Stolfo, S. J. & Jebara, T. Behavior-based network traffic synthesis, 338–344 (2011).
Kitchenham, B. Procedures for Performing Systematic Reviews. Keele, UK, Keele Univ. 33 (2004).
Mozo, A., Gonz´alez-Prieto, A., Pastor, A., G´omez-Canaval, S. & Talavera, E. Syn thetic flow-based cryptomining attack generation through Generative Adversarial Networks (2021).
Dutta, P., Ryan, G., Zieba, A. & Stolfo, S. Simulated User Bots: Real Time Testing of Insider Threat Detection Systems, 228–236 (2018).
Mammadov, S., Mehta, D., Stoner, E. & Carvalho, M. M. High fidelity adaptive cyber emulation, 1–8 (2017).
Huang, X., Wang, X., Liu, Y. & Xue, Q. A Distributed Traffic Replay Frame work for Network Emulation. Information 14, 59 (2023). URL https://www. mdpi.com/2078-2489/14/2/59. Number: 2 Publisher: Multidisciplinary Digital Publishing Institute.
Luglio, M., Quadrini, M., Roseti, C. & Zampognaro, F. A Flexible Web Traffic Generator for the dimensioning of a 5G backhaul in NPN. Computer Networks 221, 109531 (2023). URL https://www.sciencedirect.com/science/article/pii/ S1389128622005655.
Park, M., Lee, H., Kim, Y., Kim, K. & Shin, D. Design and Implementa tion of Multi-Cyber Range for Cyber Training and Testing. Applied Sciences (Switzerland) 12 (2022). URL http://www.scopus.com/inward/record.url?scp= 85144906378&partnerID=8YFLogxK.
Medenou Choumanof, R. D. et al. Introducing the CYSAS-S3 Dataset for Operationalizing a Mission-Oriented Cyber Situational Awareness. Sensors 22, 5104 (2022). URL https://www.mdpi.com/1424-8220/22/14/5104. Number: 14 Publisher: Multidisciplinary Digital Publishing Institute.
Menendez, D., Garcia, J., Lopez, P. & de Sousa, J. M. How to validate traf fic generators. ACM SIGMETRICS Performance Evaluation Review 38, 24–35 (2010).
Du, L. et al. DBWE-Corbat: Background network traffic generation using dynamic word embedding and contrastive learning for cyber range. Comput ers e Security 129, 103202 (2023). URL https://www.sciencedirect.com/science/ article/pii/S0167404823001128.
Oesch, S., Bridges, R. A., Verma, M., Weber, B. & Diallo, O. D2U: Data Driven User Emulation for the Enhancement of Cyber Testing, Training, and Data Set Generation, 17–26 (ACM, Virtual CA USA, 2021). URL https://dl.acm.org/doi/ 10.1145/3474718.3475718.
Hernandez-Campos, F., Jeffay, K. & Smith, F. D. Modeling and generating TCP application workloads, 280–289 (2007).
Li, L., Hao, Z., Zhang, Y., Ding, Z. & Fei, H. Wang, G., Zomaya, A., Martinez, G. & Li, K. (eds) Traffic Replay in Virtual Network Based on IP-Mapping. (eds Wang, G., Zomaya, A., Martinez, G. & Li, K.) Algorithms and Architectures for Parallel Processing, Lecture Notes in Computer Science, 697–713 (Springer International Publishing, Cham, 2015).
Liu, H., An, L., Ren, J. & Wang, B. An Interactive Traffic Replay Method in a Scaled-Down Environment. IEEE Access 7, 149373–149386 (2019). Conference Name: IEEE Access.
Abrahamsson, H. & Ahlgren, B. Using empirical distributions to characterize Web client traffic and to generate synthetic traffic, Vol. 1, 428–433 vol.1 (2000).
Cao, J. et al. Stochastic models for generating synthetic HTTP source traffic, Vol. 3, 1546–1557 vol.3 (2004). ISSN: 0743-166X.
Patil, B. R., Moharir, M., Mohanty, P. K., Shobha, G. & Sajeev, S. Ostinato - A Powerful Traffic Generator, 1–5 (2017).
Khayari, R., Rucker, M., Lehmann, A. & Musovic, A. ParaSynTG: A param eterized synthetic trace generator for representation of WWW traffic, 317–323 (2008).
Bhatia, S., Schmidt, D., Mohay, G. & Tickle, A. A framework for generat ing realistic traffic for Distributed Denial-of-Service attacks and Flash Events. Computers e Security 40, 95–107 (2014). URL https://www.sciencedirect.com/ science/article/pii/S0167404813001673.
Geyer, F., Schneele, S. & Carle, G. in RENETO, a realistic network traffic generator for OMNeT++/INET 73–81 (ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering), Brussels, BEL, 2013).
Mishra, S., Sonavane, S. & Gupta, A. Study of Traffic Generation Tools 4 (2015).
Yamin, M. M., Katt, B. & Gkioulos, V. Cyber ranges and security testbeds: Sce narios, functions, tools and architecture. Computers e Security 88, 101636 (2020). URL https://www.sciencedirect.com/science/article/pii/S0167404819301804.
Anande, T., Al-Saadi, S. & Leeson, M. Generative adversarial networks for net work traffic feature generation (2023). URL https://www.scopus.com/inward/ record.uri?eid=2-s2.0-85151453121&doi=10.1080%2f1206212X.2023.2191072& partnerID=40&md5=b111726b6dfe45de2e64530d753d774c.
Mozo, A., Gonz´alez-Prieto, , Pastor, A., G´omez-Canaval, S. & Talavera, E. Synthetic flow-based cryptomining attack generation through generative adver sarial networks (2022). URL https://www.scopus.com/inward/record.uri?eid= 2-s2.0-85124259395&doi=10.1038%2fs41598-022-06057-2&partnerID=40&md5= d877c3d5dc54711863c49cfaf1db1268.
Choumanof, R. et al. Introducing the cysas-s3 dataset for opera tionalizing a mission-oriented cyber situational awareness (2022). URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85137684685&doi=10. 3390%2fs22145104&partnerID=40&md5=af730a6530c706d2dae6b21b7da586b3.
Hui, S. et al. Knowledge enhanced gan for iot traffic generation (2022). URL https: //www.scopus.com/inward/record.uri?eid=2-s2.0-85129850390&doi=10.1145% 2f3485447.3511976&partnerID=40&md5=036e75482aa6d695314e3a64f359af98.
Meslet-Millet, F., Mouysset, S. & Chaput, E. Necstgen: An approach for realistic network traffic generation using deep learning (2022). URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85146938997& doi=10.1109%2fGLOBECOM48099.2022.10000731&partnerID=40&md5= daaac4118fa81881e3c99632dbc2c35c.
Nukavarapu, S., Ayyat, M. & Nadeem, T. Miragenet - towards a gan based framework for synthetic network traffic generation (2022). URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-85146606694& doi=10.1109%2fGLOBECOM48099.2022.10001494&partnerID=40&md5= ee7a171c3b1f4cd8d6f8181614eae676.
Aceto, G., Guida, C., Montieri, A., Persico, V. & Pescape, A. A first look at accurate network traffic generation in virtual environ ments (2022). URL https://www.scopus.com/inward/record.uri?eid=2-s2. 0-85141181660&doi=10.1109%2fISCC55528.2022.9913058&partnerID=40&md5=cebf64f787f4d63f10604e2887218421.
Alsulami, K., Zhang, J. & Ye, F. A real application enabled traffic generator for networking ai model development (2021). URL https://www.scopus.com/ inward/record.uri?eid=2-s2.0-85115690811&doi=10.1109%2fICC42927.2021. 9500976&partnerID=40&md5=efa7e9ef4f4b5ef3cd712805c2ad57bb.
Lee, C. Method for providing background traffic using ip random assign ing in cyber range (2021). URL https://www.scopus.com/inward/record. uri?eid=2-s2.0-85133355363&doi=10.1049%2fell2.12102&partnerID=40&md5= 58f29eacf5afd109b1764a0f3816a14f.
Brand, P., Falk, J., Maier, T. & Teich, J. Simulating realistic iot network traf fic using similarity-based dse (2021). URL https://www.scopus.com/inward/ record.uri?eid=2-s2.0-85133895167&doi=10.1109%2fCSCI54926.2021.00276& partnerID=40&md5=4d8bd964b6d0c7b3b26eb4e6ca456fd1.
Yang, H. et al. Research and implementation of user behavior simulation tech nology based on power industry cyber range (2021). URL https://www.scopus. com/inward/record.uri?eid=2-s2.0-85126873005&doi=10.1109%2fICIBA52610. 2021.9688007&partnerID=40&md5=5eac3b0752c62d74a1640a59206ee944.
Meddahi, A., Drira, H. & Meddahi, A. Sip-gan: Generative adversarial networks for sip traffic generation (2021). URL https://www.scopus.com/ inward/record.uri?eid=2-s2.0-85123400709&doi=10.1109%2fISNCC52172.2021. 9615632&partnerID=40&md5=5ef29e4d852526bf2faa38e048fd7ba1.
Li, L., Hao, Z., Zhang, Y., Liu, Y. & Li, D. Modeling for traffic replay in virtual network (2019). URL https://www.scopus.com/inward/record.uri?eid= 2-s2.0-85062547060&doi=10.1109%2fHPCC%2fSmartCity%2fDSS.2018.00096& partnerID=40&md5=506123005232965c80f149d3702deb0a.
Wu, H., Liu, H., Wang, B. & Xin, G. Accurate traffic replay based on interactive sequence and timestamp (2017). URL https://www.scopus.com/inward/record. uri?eid=2-s2.0-85049089539&doi=10.1109%2fICCSN.2017.8230282&partnerID= 40&md5=69f28d308be6611249a331762a195806.
Chapman, S., Smith, R., Maglaras, L. & Janicke, H. Can a network attack be simulated in an emulated environment for network security training? (2017). URL https://www.scopus.com/inward/record.uri?eid= 2-s2.0-85029527502&doi=10.3390%2fjsan6030016&partnerID=40&md5=f491d104c994872ee148c4241d701479.
Kuang, J., Waddington, D. & Lin, C. Techniques for fast and scalable time series traffic generation (2015). URL https://www.scopus.com/inward/record.uri? eid=2-s2.0-84963753383&doi=10.1109%2fBigData.2015.7363747&partnerID= 40&md5=0742f182e4fb9e22350131fbc20cfd8d.
Su, X., Zhang, D., Li, W. & Wang, X. Androgenerator: An automated and configurable android app network traffic generation system (2015). URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-84959364687&doi=10. 1002%2fsec.1341&partnerID=40&md5=22f3f19c76801d0001b5da2f160133b8.
Qian, Y., Guan, X., Jiang, M. & Cen, G. Modeling and generat ing realistic background traffic by hybrid approach (2015). URL https: //www.scopus.com/inward/record.uri?eid=2-s2.0-84947278927&doi=10.1109% 2fCC.2015.7315066&partnerID=40&md5=421cfc65d9474ea83bdeec53a3c5c3e4.
Gupta, M., Durairajan, R., Syamkumar, M., Barford, P. & Sommers, J. Pfs: Parallelized, flow-based network simulation (2015). URL https://www.scopus. com/inward/record.uri?eid=2-s2.0-84992166095&doi=10.1109%2fSPECTS. 2015.7285287&partnerID=40&md5=76e3de3001c4022e7c2c3bbd65a68dd0.
Kokkonen, T. et al. Analysis of approaches to internet traffic generation for cyber security research and exercise (2015). URL https://www.scopus.com/inward/ record.uri?eid=2-s2.0-84948991180&doi=10.1007%2f978-3-319-23126-6 23& partnerID=40&md5=88da448d5f23ca2ef30c44728c879546.
Mirzaei, M., Mizanian, K. & Rezaeian, M. Modeling of self-similar network traffic using artificial neural networks (2014). URL https://www.scopus. com/inward/record.uri?eid=2-s2.0-84921033177&doi=10.1109%2fICCKE.2014. 6993452&partnerID=40&md5=9149808229aaa91239ba52b459a69f6c.
Hussain, A., Pradkin, Y. & Heidemann, J. Replay of malicious traffic in net work testbeds (2013). URL https://www.scopus.com/inward/record.uri?eid= 2-s2.0-84893277091&doi=10.1109%2fTHS.2013.6699022&partnerID=40&md5= 8cec6678f24f7454957a33fdeb5f9802.
Djidjev, H. & Aleksandrov, L. Generation of ssh network traffic data for ids testbeds (2013). URL https://www.scopus.com/inward/record.uri?eid=2-s2. 0-85084160654&partnerID=40&md5=dfe876d510a2d1694544cec6dbf377ce.
Lo, O., Graves, J. & Buchanan, W. Towards a framework for the generation of enhanced attack and background network traffic for evalu ation of network-based intrusion detection systems (2010). URL https: //www.scopus.com/inward/record.uri?eid=2-s2.0-84873194589&partnerID=40&md5=db218bd78d78924bc378311836c25169.
Zhao, K., Tang, K., Chu, J. & Hu, L. Nbtrl: A software platform for net work background traffic replay based on log (2007). URL https://www.scopus.com/inward/record.uri?eid=2-s2.0-37749051946&doi=10.1109%2fCHICC.2006.4347201&partnerID=40&md5=0625009950433f0a30e7620783924c8c.

No competing interests reported.

Modeling Network Traffic Generators for Cyber Ranges: A Systematic Literature Review

Status:

Journal Publication

Version 1

Abstract

Figures

1 Introduction

2 Related works

3 Research questions

4 Methodology

5 Results

6 Discussion

7 Threats to validity

8 Conclusion

Declarations