Research On User Behavior Emulation Technology Based On Traffic Replay

With the increasingly serious situation of cyber security and the development of cloud computing technology,the cyber range has become an important infrastructure supporting cyberspace security technology research and attack-defense confrontation experiments,providing a flexible and realistic simulation environment for large-scale network user behavior emulation.At the same time,large-scale user behavior emulation as an important research content in the cyber range,can provide a basis for various new technology evaluations and cyber security situation assessments.To this end,this article takes the urgent need for largescale user behavior emulation as the background,and aims at the current user behavior simulation defects in terms of fidelity,scale,diversity,and scalability,so as to build large-scale user behavior simulation scenarios in limited and fixed computing resources,with traffic simulation as the entry point for user behavior simulation research,and in-depth research on user behavior emulation based on cloud computing,virtualization technology,and traffic replay and generation.The specific research content includes:1)Facing the simulation goal of user behavior simulation behavior diversity and concurrency,in view of the shortcomings of traditional behavior simulation methods in simulation scale and fidelity,the advantages and feasibility of user behavior simulation methods based on virtualization and traffic playback are discussed and demonstrated.Relying on the advantages of low virtualization cost and flexible scalability,it can provide large-scale user behavior simulation to quickly build highly realistic simulation scenarios,real-time distributed simulation user nodes automatically and flexibly load,and user behavior high concurrency basic support;based on traffic reoply,the traffic simulation generates differentiated user behavior traffic,which can address the simulation needs of diverse user behaviors,large concurrency scale,and high throughput,and solve the limitations of traditional modeling and simulation methods of single behavior and insufficient fidelity.2)Based on the discussion in 1),for the needs of interactive user behavior simulation for complex virtual networks,and for the lack of fidelity of traditional traffic interactive traffic replay methods,a user behavior emulation architecture based on interactive traffic playback is proposed.,Extend the playback scale from a single node to the entire target network scenario.The architecture adopts a distributed traffic simulation strategy based on a cloud platform to realize diversified and scalable loading of user behavior simulation for complex virtual networks.The delay repair and compensation strategy in the process of interactive traffic playback is further studied to improve the timing fidelity of interactive user behavior simulation.Interactive user behavior simulation experiments for complex target networks show that this method can achieve interactive large-scale user behavior simulation under the premise of ensuring the accuracy of packet timing.Compared with traditional methods,the simulation behavior is diverse.It has certain advantages in terms of diversity,scale,and fidelity.The simulation scenario of malicious user behavior based on replay attack shows that this method can provide effective support for cyber security evaluation.3)Facing the requirement of background traffic injection in large-scale user behavior eimulation scenarios,a background traffic simulation technology based on virtual and real integration is proposed.Aiming at the problem of insufficient flexibility and transparency of the virtual and real interconnection mechanism of the OpenStack cloud platform,the underlying communication architecture of the cloud platform is carried out.Improved and designed a vlanbased virtual and real fusion simulation architecture,which can build simulation nodes of different scales(virtual and physical),and perform background traffic simulation at the same time.The focus is on the virtual-real fusion mapping table and the virtual-real link switching strategy to realize the flexible and transparent transmission of the virtual-real link.The DPDKbased generation technology improves the flow injection efficiency and throughput.The constructed virtual-real fusion simulation experiment shows that compared with the existing virtual-real interconnection mechanism of OpenStack,the virtual-real link constructed by this method has certain advantages in transparency,isolation,and scalability.The performance evaluation of a single virtual simulation node shows that this method can generate highthroughput background traffic and can effectively meet the performance requirements of largescale user behavior emulation for background traffic injection.4)Based on the related technologies proposed in 2)and 3),the application interactive behavior flow simulation and background flow generation simulation are combined to construct a simulation platform for large-scale user behavior.The simulation platform is realized by multiple subsystems,which can realize the full-cycle management of large-scale simulation experiments.Facing the needs of rapid construction of cluster user behavior simulation scenarios and flexible deployment of simulation nodes,it has realized large-scale simulation scenario automation modules,centralized control of cluster simulation experiments,designed cluster simulation control strategies,and built a user behavior simulation template library to meet user behaviors diversity needs.Finally,a large-scale user behavior simulation experiment is designed.The experimental results show that the simulation platform designed in this paper has the ability to quickly build simulation scenarios and cluster simulation node scheduling,and can effectively support large-scale high-throughput user behavior simulation.