Method and system for generating synthetic digital network traffic

• US 20060274659A1
• Filed: 05/06/2005
• Published: 12/07/2006
• Est. Priority Date: 05/06/2005
• Status: Abandoned Application

• Current Assignee: Battelle Memorial Institute
• Original Assignee: Battelle Memorial Institute
• Inventors: Ouderkirk, Steven J.
• Application Number:
  US11/124,067
• Publication Number:
  US 20060274659A1
• Time in Patent Office: Days
• US Class Current: 370/241
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network

Abstract

Embodiments of the present invention encompass a method and a system for generating synthetic network traffic. The synthetic network traffic can be utilized for information operations, information assurance, and information exploitation. The method comprises the steps of providing a behavior model to an agent through a controller, operating the agent on a host, and exchanging data between a server and the agent, wherein the agent stochastically generates network traffic based on the behavior model. The system comprises an agent operating on a host, wherein the agent stochastically generates network traffic based on a behavior model. A server exchanges data with the agent, and a controller provides the behavior model to the agent. In one

Claims

1. A method for generating synthetic network traffic comprising the steps of:

a. providing a behavior model to an agent through a controller;

b. operating the agent on a host, wherein the agent stochastically generates network traffic based on the behavior model; and

c. exchanging data between a server and the agent.

2. The method as recited in claim 1, wherein the operating step further comprises the steps of:

a. providing a simulation delta-time;

b. calculating whether an activity occurs during the simulation delta-time, wherein said calculating uses an activity-probability function for the activity and a pseudo-random number generator;

if the activity occurs, then the exchanging data step further comprises performing the following steps i-iv;

i. selecting a server for an event;

ii. establishing a link to the server;

iii. transferring data between the server and an actor; and

iv. terminating the link;

c. incrementing the simulation delta-time; and

d. returning to step b.

3. The method as recited in claim 2, wherein the returning step occurs for an elapsed simulation time less than a predetermined total simulation time.

4. The method as recited in claim 2, wherein the activity comprises at least one event.

5. The method as recited in claim 2, wherein the selecting step is stochastic or deterministic.

6. The method as recited in claim 2, wherein an actor executes the activity.

7. The method as recited in claim 6, wherein actors perform at least one activity.

8. The method as recited in claim 6, wherein the actor belongs to an actor class, said actor class comprising at least one activity profile.

9. The method as recited in claim 8, wherein the activity profile specifies operational schedules, activities, operational capabilities, activity-probability functions, or combinations thereof.

10. The method as recited in claim 8, wherein the activity profile is stochastic.

11. The method as recited in claim 6, wherein a community comprises at least one actor, wherein the actor comprises an instantiation of an actor class.

12. The method as recited in claim 2, wherein the activity-probability function comprises probability definitions for mean and standard-deviation events per simulation delta-time.

13. The method as recited in claim 1, wherein the data varies in size.

14. The method as recited in claim 6, wherein the size of the data is fixed or infinite

15. The method as recited in claim 1, wherein the synthetic network traffic is generated on a network comprising a serial network.

16. The method as recited in claim 1, wherein the synthetic network traffic is generated on a network comprising an Ethernet.

17. The method as recited in claim 1, wherein the synthetic network traffic is generated on a network comprising a wireless network.

18. The method as recited in claim 1, utilizing protocols selected from the group consisting of Supervisory Control And Data Acquisition (SCADA), HTTP, SMTP, TCP/IP, and combinations thereof.

19. The method as recited in claim 18, wherein the SCADA protocol is Modbus, Distributed Network Protocol Version 3.0 (DNP3), Conitel, IEC 60870-5-101, RP-570, or a combination thereof.

20. The method as recited in claim 1, wherein a host comprises at least one agent.

21. The method as recited in claim 20, wherein a controller manages at least one host.

22. The method as recited in claim 1, wherein management of the synthetic network traffic generation is controlled from a different subnet than that on which the synthetic network traffic is generated.

23. The method as recited in claim 1, further comprising the step of collecting traffic metrics through the agent.

24. The method as recited in claim 1, wherein a simulation clock is independent of a host system clock.

25. A system comprising:

a. An agent operating on a host, wherein the agent stochastically generates synthetic network traffic based on a behavior model.

b. A server exchanging data with the agent;

c. A controller providing the behavior model to the agent.

26. The system as recited in claim 25, wherein the system utilizes a plurality of software platforms.

27. The system as recited in claim 25, wherein the agent comprises at least one actor

28. The system as recited in claim 27, wherein the actor executes at least one activity according to the behavior model.

29. The system as recited in claim 27, wherein the actor is a member of an actor class

30. The system as recited in claim 25, wherein the data comprises controlled content.

31. The system as recited in claim 25, the data is random, static, accessed arbitrarily from a predefined data set, dynamically generated, or combinations thereof.

32. The system as recited in claim 25, wherein the server is a real server or an emulated server.

33. The system as recited in claim 25, wherein agents collect traffic metrics.

34. The system as recited in claim 25, further comprising a simulation clock independent of the host system clock.

35. The system as recited in claim 25, wherein the actor is capable of executing a plurality of activities substantially simultaneously.

36. The system as recited in claim 25, wherein the controller operates on a different subnet than that on which the synthetic network traffic is generated.

37. The system as recited in claim 25, wherein the synthetic network traffic is generated on a network comprising a serial network.

38. The system as recited in claim 25, wherein the synthetic network traffic is generated on a network comprising an Ethernet.

39. The system as recited in claim 25, wherein the synthetic network traffic is generated on a network comprising a wireless network.

40. The system as recited in claim 25, utilizing protocols selected from the group consisting of Supervisory Control And Data Acquisition (SCADA), HTTP, SMTP, TCP/IP, and combinations thereof.

41. The system as recited in claim 40, wherein the SCADA protocol is Modbus, Distributed Network Protocol Version 3.0 (DNP3), Conitel, IEC 60870-5-101, RP-570, or a combination thereof.