Validation of the finite state machine model for network simulation and a proposed testbed

Abstract

Under the Cyber Army Modeling and Simulation (CyAMS) program a new model has been created to efficiently model various cyber events. The finite state machine model allows for the modeling of applications by creating behaviors that map to properties of real world applications. The finite state machine model is originally implemented by utilizing the ns-3 parallel discrete event simulator and validated using data from an emulation testbed experiment featuring malware applications. Following the completion of the ns-3 validation work, the CyAMS behavioral simulator was developed to allow for larger scale networks to be modeled, while also allowing both the network and applications to be defined using a behavioral network. This allows for the creation of an accurate mapping between both the simulation and the emulation applications. Validation tests are then carried out to determine both the validity of the model and the potential scalability. Finally, a testbed is proposed that will combine behavioral simulation, traditional parallel discrete event simulation, and emulation. The creation of this end-to-end environment for cyber simulation will allow past, present, and potentially future cyber events to be modeled in order to help understand and potentially mitigate future malicious attacks.