Can a Network Attack Be Simulated in an Emulated Environment for Network Security Training?

Abstract

This paper outlines a tool developed with the purpose of creating a simple configurable emulated network environment that can be used in cyber defence exercises. Research has been conducted into the various related subject areas: cyber defence exercises, network threats, network emulation, network traffic replay, network topologies, and common network services. From this research a requirements specification was produced to encapsulate the features required to create this tool. A network, containing many of the aspects researched, was designed and implemented using Netkit-NG to act as a blueprint for the tool and to further knowledge in the construction of an emulated network. Following this the tool was developed and tested to ensure requirements were met.

1. Introduction

Computer security is an essential part of keeping an organisation’s data safe from malicious affect. One aspect of computer security is security of a network which is used to ensure networked computers and servers are reliably available to users, and data on these devices is secure. To ensure a network is secure network security experts are required to respond to threats as they appear. These experts are required to be trained in the various aspects of network security and have a strong knowledge base of various network services and how these can be secured [1]. One method of training is creating cyber defence exercises. These exercises utilise a blue team and a red team. The blue team is tasked with defending and securing a network, whereas the red team’s objective is to attack the network. These exercises do not take place on live networks due to their nature, instead, a network is created with this purpose in mind [2].

Virtualised cyber security training and facilities are offered by several organisations, among these are the SysAdmin, Audit, Network, and Security (SANS) Institute [3], and Offensive Security [4]. The SANS Institute does not go into specifics regarding the training only that it offers hands on experience and utilises virtual lab environments which are capable of simulating “the most prevalent tactics and technologies”. Offensive Security on the other hand offer more insight into their training stating that they utilise a virtual network of more than forty systems, ranging “from locked down modern servers to classic configurations still found in networks everywhere”. Both offer network security training, however, neither states whether they allow customisation to their virtual networks. This work offers the ability to customise the structure of the network with ease. The creation of a network and simulation of traffic, both neutral and otherwise, can be time consuming; this work allows a network, containing a number of services, to be produced to a specification quickly and traffic to be subsequently simulated on it. The CyRIS (Cyber Range Instantiation System) [5] is a tool similar in function to that proposed. The proposed tool does, however, obfuscate more of the cyber range’s creation by only asking the types of devices the user would like. CyRIS requires the user to have knowledge enough regarding networks to create a configuration file which it will use to create the virtual machines and install other software to start the range; the proposed tool will require no such knowledge and will produce simulated attacks and traffic at random intervals. Another commercial offering in Raytheon’s cyber range [6] which like CyRIS is fully customisable, on their website they quote that a customised cyber range can be created in a matter of hours, whereas the tool created by this work may be less complex but can ultimately create a full network in a matter of minutes. The Cyberbit range is yet another designed with the intention of training computer security professionals [7]. As with Offensive Security’s offering this range is large and extensive but is not customisable for the end user. The various cyber ranges looked at here show that there are a number of different offerings with various features. The tool designed in this work is unique in that it is a capable of constructing a full network quickly and without extensive knowledge, which will ultimately allow focus to be shifted more towards cyber security training rather than maintaining the cyber range.

Network emulation tools are used to mimic a real network environment, and can therefore be used for cyber defence exercises. These tools have to be configured to specifications created by an end-user. This can be a long process given the possible number of network services required to create a network. This article presents a research that was conducted into cyber defence exercises, network threats, network emulation, network traffic replay, network topologies, and network services. A tool that is capable of creating an emulated network containing the various services found from the research is presented. This tool is capable of mimicking network traffic produced by normal usage of network services, also known as white traffic, in an attempt to obfuscate any malicious network traffic that might be produced in a cyber defence exercise.

The contributions of this article are:

• Design and implement a virtual network utilising common network services (see Section 3).
• Add the ability to configure the network based on user requirements (see Section 5).
• Generate and capture network traffic that simulates normal network usage (see Section 4.1 and Section 4.2).
• Automatically replay captured network traffic (see Section 4.3).
• Test the system (see Appendix B).
• Randomise the replay of captured network traffic, to further obfuscate any traffic of a malicious nature (see Section 4).

The tool produced by this work allows professionals to receive training in the security of sensor/actuator networks in a variety of user definable network scenarios. This tool also allows the production of a complex virtual network, and the simulation of network traffic, without requiring an extensive background in that area by creating the virtual network based solely on user input. This allows more focus to be placed on training professionals than setting up and maintaining the network, the attack simulation element of this tool also means common threats can be simulated with ease and without intimate knowledge of the tools required to attack a network, thus shifting focus more on defence and protection of a network.

Paper Discovery Method

The procurement of information regarding this subject was conducted in a specific manner. Firstly, the heading of a section was searched, initially this was done within specific parameters. Initially the date was considered, this was confined to papers written after 2005 to ensure current validity of data, the most recent papers were considered first. Also the number of citations was looked at in an effort to determine impact within the research area. These search terms were not binding however as this was sometimes inappropriate. For example the use of the Request for Comments (RFC) pages in Section 2.6 was deemed acceptable, although these pages could be considered dated, as these were the documents that defined the protocols making them a very relevant source. The title of a document was then looked at to determine relevance to the subject area, the abstract of the document was looked at in the same manner. Once this had been done, the papers were read in more detail and the content used where appropriate.

2. Related Work

In this section we present all related work that is related to our work including, network emulators, common network threats, the construction of a network, and services that are common throughout networked systems. It takes into account the various aspects required for this system, and aids in making informed decisions regarding the tools and configuration required.

2.1. Cyber Defence Exercises

Cyber defence exercises usually consist of at least two teams, one defending a computer network (blue team) and the other attacking it (red team). This type of exercise is often used for training students and security teams. It also offers an opportunity to see how a team would react if under an actual cyber-attack. The United States National Security Agency (NSA) has been conducting these exercises since 2001 [8]. Both Mullins, and Adams et al. [9] agree that these exercises offer invaluable hands on experience and are an effective method of training people in proper cyber defence. Both agree this is because trainees are put in a pressurised environment during the exercise. However Adams takes this further suggesting it is also the element of teamwork inherent to these exercises that makes them truly effective methods of training. The cited authors come from military backgrounds, which could bring into question the reason they strongly approve of cyber defence exercises. However, most of the evidence gathered is from user experience and there are multiple reviewers at these events. Although this type of exercise has been going on for many years there has been little or no previous research into simulated red teams attacking a network.

2.2. Network Threats

A threat is something that has the capability of affecting any part of an organisation in a negative way [10].

2.2.1. Threat Actors

A threat actor is an individual or group posing a threat [10]. Threats can come from a number of different actors, each with different motives and levels of funding. National Institute of Standards and Technology (NIST) has produced several scenarios where different threat actors are present. However, the SysAdmin, Audit, Network, and Security (SANS) institute and the National Cyber Security Strategy explicitly state what they believe are key threat actors:

• Cyber Criminals—Individuals or groups that attack systems for financial gain, for reputation, for performing malicious activities, for carrying out “conventional crime” or for erasing data.
• States or State Sponsored—Individual or groups funded by governments to attack systems typically used for cyber espionage or to cause damage.
• Hacktivists—Individuals or groups who attack systems for political or social reasons.
• Terrorists—Individuals or groups that attack systems to cause damage and destroy.
• High Privileged Insiders—Individuals or groups with privileged user access seeking financial gain.
• Partner—Trusted partner of an organisation seeking financial gain or a competitive advantage.

Although not all documents agree on each actor they all pose a threat to an organisation or nation. Also, the NIST and United Kingdom’s documentation holds governmental authority, making them viable sources of information even if they do not directly agree on all matters.

2.2.2. Attack Taxonomy

Network attacks can take many forms and several taxonomies have been produced by various groups in order to express these forms. Most of these taxonomies share similarities and it is the common attacks that will be discussed. However, attacks not pertaining to networked systems and attacks utilising human-computer interaction have been deemed irrelevant for the given context. The McAfee threats report [11] has been used in conjunction with other various taxonomies to ascertain how prevalent the types of attack are. This report outlines various statistics of threats detected by McAfee’s various security applications.

Denial of Service (DOS) is discussed by a number of papers, each with very similar definitions. This type of attack aims to prevent legitimate users accessing network resources [12] by overwhelming the target system with non-legitimate requests. Chapman, [13], goes on to discuss a Distributed DOS (DDOS) which utilises a number of computers to overwhelm the target. This is somewhat more sophisticated and is harder to defend as there are many sources of the attack. Although the paper written by Hansman and Hunt [12] is several years old, Chapman’s paper shows that the make-up of a DOS attack has not changed in a significant way. In the third quarter of 2016 DOS made up 33% of network attacks which is the largest proportion in the McAfee report. This shows that this type of attack is likely to be seen a lot by network security practitioners.

Brute force attacks made up 18 % of attacks in the third quarter of 2016 showing that they are a significant threat to networks. Chapman describes this type of attack as attempting all possible password combinations. While this type of attack is not particularly sophisticated it poses a clear threat to networked systems. A Domain Name Service (DNS) attack is an attack that aims to send legitimate web users to illegitimate websites. The attacker will pose as a DNS server and then direct users to a fake web page rather than the intended one. This is usually a website which the user has to log in to [14]. This type of attack gives the attacker various user credentials that can be used in a legitimate system. This type of attack made up 4% of the attacks in the third quarter 2016 [15]. The information found clearly shows the prevalence of the different types of network attack. This data will be used to produce the attacks featured in the proposed system.

2.3. Network Emulation

Network emulators offer the ability to mimic a network without the need for the requisite equipment, such as cables, routers, server computers, etc. There are many different emulators available, each offering various features to aid the environment creation process. The work of Fuertes and Vergara [16] attempts to measure the resource consumption of several emulators. The emulators chosen for review may have changed functionally since the date of the aforementioned publication, however, this is taken into consideration.

2.3.1. Netkit

Netkit is a free, open source emulator which includes several real world tools to enable the creation of servers. Each device started via Netkit uses a kernel based on the Debian Operating System (OS) which is an OS in use today [17]. The use of a real-world OS allows the installation of software that is not natively available on the virtual machines. The work of Wolny and Szoltysik [17] may be biased, as they discussed Netkit in much greater detail than other software in their overview. They have also stated that Netkit is an available feature in a teaching operating system. Netkit labs can be set up using a set of text files that describe the virtual machines and the desired configuration meaning the labs do not require much storage space per machine which in turn makes it easy to transfer the labs to different machines [18]. It should be noted that Pizzonia and Rimondini are on the team that created Netkit so they are unlikely to have objective views on the subject, that being said, they would be well versed on Netkit’s features. As mentioned previously, Netkit machines use the Debian kernel however, the kernel in use is Debian Lenny which has been deprecated since 2012. It should also be noted that the most recent stable version of Netkit was released in 2011. There is a variation of Netkit called Netkit-NG, this uses a more recent version of the Debian kernel, Debian Wheezy, and was last updated in 2015. Netkit-NG also offers several different features, whilst still being functionally similar to Netkit.

2.3.2. Virtual Network User-Mode Linux (VNUML)

Similar to Netkit, VNUML is an open source emulator, however rather than using a specific kernel VNUML uses the current OSs kernel. Because of this the user has to have elevated privileges for some of the configuration [19]. In order to create a VNUML lab the user must write a file using a variant of eXtended Markup Language (XML) specific to VNUML. The whole lab is contained in a single file, split into two parts; virtual machines (VMs) and virtual networks [20] unlike Netkit which has several files describing each VM. The referenced document was written by the developers of the application. The segment of interest regards features rather that performance statistics or a comparison. VNUML has been superseded by a newer version of the tool called Virtual Networks over linuX (VNX). VNX offers some new features but essentially works in the same way as VNUML, development and maintenance of VNUML has been abandoned.

2.3.3. VMware Server

VMware server is different in comparison to the aforementioned emulation software packages. VMware server can support multiple operating systems in a single network which means you are able to have the Windows OS running on one network node and Linux on another. This feature allows the user a wider range of network capabilities [21]. Since writing the paper, Li [21] has been cited several times in other papers, however VMware server has been updated since then and some of its features have changed in that period. To create a VMware server lab, the user must install the desired operating system on a Virtual Machine (VM) and manually set it up as though it were a stand-alone machine. They must then configure virtual network adapters on the host machine to allow several machines to communicate. When compared to VNUML or Netkit, this could be considered a lengthier setup process. The VM will also be contained within a single folder containing files which cannot be edited while the VM is running. Unlike the previous emulators, VMware has not been changed developers or names and is still maintained today.

Although each emulator is similar they all offer varying functions. Except from the aforementioned emulators there exist a number of others that can be used for conducting similar tasks e.g., GNS [22], Dynagen [23], Velnet [24], ModelNet [25], Vagrant [26], Vnet [27] among others. Betwwen the three emulators that we described more analytically in this section, VMware Server is somewhat more difficult to setup and configure than the other options although it is able to offer more flexibility in terms of its functions. VNUML and Netkit allow the user to setup VMs using text files or folder structures stored on the host machine. This means that changes can be done without starting the lab. Netkit structures lab configuration using machine specific folders and start-up scripts allowing the user to see at a glance what is going to be emulated. This may be a more appropriate option for creating a pre-configurable network lab.

2.4. Replay of Network Traffic

In order to make the proposed environment more realistic, network traffic is captured and replayed across the networked system. This will help to obfuscate any red team traffic that will occur on the network creating more of a challenge for the blue team. After some research, the most appropriate tool for this task is Tcpreplay. Tcpreplay gives a user the ability to replay captured traffic onto a network. It also allows the user to edit the packets to a certain degree, meaning the source and destination addresses could be changed to suit the network. This information was taken directly from the maintainer’s website, although they may be biased regarding the utility the description and features are the only items taken from this rather than data regarding its effectiveness. Although the aforementioned website does not discuss Tcpreplay’s performance, tests conducted by Hillstead et al. [28] indicate that the tool is able to reproduce accurate traffic that is produced as and when the user requires.

2.5. Network Topologies

The topology of a network refers to how network nodes are both physically and logically linked. The topology can affect the cost of a network and its integrity, so it should be something carefully considered. To effectively emulate a realistic network, an understating must be established regarding the most common topologies that are currently in use. Network topologies are rarely changed or redesigned therefore there does not seem to be a lot of research in this specific area. From several books, that cover basic network topics, the works selected have been cross-referenced with each other in an attempt to ensure information is correct and unbiased. There are four key network topologies, mesh, star, bus, and ring.

2.6. Common Network Services

Network services give a network various features such as file storage, the ability to produce web pages, email, etc. It is imperative that common services are used to properly emulate a corporate network and the attacks associated with them. A list of widely used services was generated by cross referencing the works of Dean [29], Duck and Read [30], Kurose and Ross [31], and White [32]. To get information about these protocols, their Request For Comment (RFC) pages have been used. An RFC is where a protocol has been defined and informs people in how communications utilising them should look. These are produced by the Internet Engineering Task Force (IETF) who are responsible for producing technical documents regarding internet protocols.

2.7. Email

Email is widely used around the world to send messages. There are three key protocols associated with email, Post Office Protocol—version 3 (POP3), Internet Message Access Protocol (IMAP), and Simple Mail Transfer Protocol (SMTP). The SMTP protocol is designed to transfer and deliver mail between two nodes, this is one of the most common protocols for sending an email. IMAP and POP3 are both protocols designed for retrieving mail from a server. Accessing mail on a server is often seen as a cheap solution as it means user’s PCs do not have to have SMTP capabilities in order to receive mail. POP3 is used to download mail from a server directly to a PC. Once it is downloaded, the user is able to read and delete the mail, however, the mail will no longer exist on the server. The IMAP protocol allows users to access the server on which their mail is stored, from there they are able to manipulate it as though it were on their own device. This gives users the ability to access their mail from any device as long as they can access the server. IMAP would be the preferred protocol as it gives users more flexibility with the device they use. Except from the above, webmail that is any email client implemented as a web application running on a web server is an option widely used nowadays.

2.8. File Transfer

The transfer of files is required by most organisations as a method of sharing and storing data. This process is facilitated by the File Transfer Protocol (FTP). This protocol allows users to share and view data on a remote server. There are variants of FTP which allow a degree of security for file transfers, Secure File Transfer Program (SFTP) and FTP over SSL (FTPS). SFTP is very similar to FTP however it completes all tasks over an encrypted Secure Socket Shell (SSH) channel. The user will connect and then log in to the SFTP server then commence communication. FTP over SSL (FTPS) offers encryption for the FTP protocol using Secure Socket Layers (SSL) or Transport Layer Security (TLS). The use of this encryption must be specified when connecting to the server [33].

2.9. Webpages

The Hypertext Transfer Protocol (HTTP) is used for data transfer across the internet, and is commonly used for webpages. A variant of HTTP is Hypertext Transfer Protocol Secure (HTTPS) which uses SSL or TLS to encrypt traffic (Rescorla, 2000) in a similar way to FTPS. DNS is a method used to resolve human readable Uniform Resource Locators (URL) into an Internet Protocol (IP) address. This system is used throughout the internet for web pages and connecting to servers remotely. DNS is also used for addressing email. A database is used that contains both the URL and the IP it refers to, from which the URL can be resolved. This database is updated manually. A similar protocol, known as Dynamic Domain Name System is used for the same end. The key difference is that this system allows for updates to the database that contain the URLs and IP addresses dynamically from the network. Dynamic Host Configuration Protocol (DHCP) is a protocol that allows the automatic assigning of IP addresses. This is used so new devices do not have to be manually configured to be seen on the network. This is used by organisations as it makes it easier to add new devices to their networks.

2.10. Remote Access

There are two protocols that are commonly used for remote system access. The telnet protocol allows a user to connect to a networked device and use various system commands for general use of that system. The telnet protocol does not include any user authentication steps which leaves it open to attackers. The SSH protocol works in a similar way to Telnet however it requires users to provide credentials to gain access to the system making it somewhat more secure.

The literature surrounding the subject suggests that an automated system able to simulate network attacks has not before been devised. However, given the benefits of cyber defence exercises, an automated system would be beneficial as it should enable teams to train or learn cyber defence techniques without having to create two different teams: attack, and defence. The literature reviewed has also given indication as to the more prevalent attacks in recent times as well as various protocols that are used in modern day networks. These are taken into consideration when constructing the proposed system.

2.11. Key References

There were a number of important sources found during the review of the various literature, these have been reduced to the three considered most influential to the writings. The paper written by Adams et al. (2009) regarding cyber defence exercises is very important as it validates the reasons that such exercises have started, for the training of network security teams. Dean’s book (2012) regarding networking was another influential piece of work for this review. It shows what topologies are available to choose from and states, in the author’s opinion, which is best. It also goes on to explain the various networking protocols that are in common use today which was useful as a stepping stone to analysing these protocols. Fuertes and Vergara’s work (2007) outlines the various network emulators that are available. Although this work was written several years ago, it is one of the few that offer a direct comparison of available emulators without discussing possible matters of opinion.

3. Network Overview

The network has been implemented in a Netkit environment and includes many of the services discussed in the literature review (see Section 2.6). A summary of this network is provided however a more in depth technical explanation, of both the network setup and Netkit-NG setup, has been provided. The topology used mimics that of a star-wired bus, as it was decided from the various literature that this was the most suitable for a network attempting to mimic that used in a corporate environment. Figure (see Figure 1) shows the network in this topology with the various nodes that appear on it. This network has been split into several collision domains, which act as the different areas of the topology.

3.1. Collision Domain: TAP

The diagram depicts five collision domains, A, B, C, D, and TAP. The tap collision domain is used to provide access to the wider internet via the host computer, it will also allow the user to interact with the emulated network via the host machine, a more in depth view of the TAP node. It was deemed that this feature should be implemented to allow the network to better produce traffic by interacting with the internet.

3.2. Collision Domain: D

Collision domain D contains the routers of the network. These routers allow network traffic to be transported throughout the other collision domains. As well as routing, the nodes on this collision domain act as DHCP relays, by utilising the ISC-DHCP-Relay tool. This allows them to forward DHCP packets from the DHCP server on collision domain A to the nodes on their subnet.

3.3. Collision Domains: B & C

Collision Domains B and C contain remote PCs. These nodes do not utilise any servers and are used to simulate standard network nodes without special function. Netkit-NG does not have a web browser installed by default so this has to be done when the remote PCs initially start-up. This process is scripted so that the user does not have to do this, nor does the user require an internet connection for this. The web browser chosen was Links as this is an easy to use browser that can operate in the Linux terminal. Pine, an email client, is also used on these nodes. This is a simple text based mail client which allows users to view and send emails. This was chosen as it requires little configuration to function and it is possible to use without a graphical interface. To give users individual mailboxes, several accounts were created on the email server, which are logged into when Pine is started on the remote PC.

3.4. Collision Domain: A

Collision domain A contains all of the servers for the network, documentation for the setup procedures of this collision domain has been provided. The servers were placed on the same collision domain to make the setup process easier and to make the network simpler to understand to those that need to use it.

3.4.1. File Transfer Protocol (FTP) Server

The FTP server daemon used is ProFTPD, this was chosen for a variety of reasons. ProFTPD is available on Netkit-NG, this means that there is no requirement to script its installation therefore reducing its time to start-up. It is also possible to configure FTP, SFTP, and SFTP, using this server daemon which offers a level of convenience during network setup. Several user accounts have been set up on this server to allow login when a connection is established.

3.4.2. SSH File Transfer Protocol (SFTP) Server

The SFTP server is set up in the same way as the FTP server; however, it uses SFTP to ensure a higher level of security on the server. After some testing it was found that ProFTPD was unable to run FTP and SFTP server concurrently, it was therefore decided that they should run on separate nodes.

3.4.3. Hypertext Transfer Protocol (HTTP) Server

The HTTP protocol has been implemented via the apache daemon. Like ProFTPD this was already installed on Netkit-NG so using this was the preferred choice to reduce network start-up time. This daemon also offers HTTPS functionality which has been implemented on the same node. Whether to have a separate HTTPS node was considered, however, to include both HTTP and HTTPS on the same node had no foreseeable drawbacks and helped to consolidate services making the network as a whole easier to understand.

3.4.4. Email Server

The email server makes use of the IMAP, POP3, and SFTP protocols. To do this, it uses two server daemons, exim4, and OpenBSD-inetd. Initially, there were no daemons capable of handling email, so these are installed via script when the email server starts-up. Exim4 is used as the Mail Transfer Agent (MTA), which is used to handle emails and ensure they get to their proper destination. This server was chosen as it was found to be easy to set up and capable of handling both the POP3 and IMAP protocols. It was found in the literature review that IMAP was considered more appropriate for the given scenario. POP3 capabilities did not take any more time to implement in exim4 and allow the user to use this if it is required. OpenBSD-inetd has been used to direct any traffic, that uses POP3 or IMAP, coming to the user to the imapd and ipop3d programs. These programs are open source and enable access to the mailbox directory on the email server. OpenBSD-inetd was chosen as it is simple to direct specific traffic to an application. The imapd and ipop3d programs were used as they do not require installation to use, thus cutting start-up time. They also do not require much configuration.

3.4.5. DHCP Server

The daemon chosen to implement DHCP was ISC-DHCP-Server. This daemon was chosen as the configuration files are easy to read and understand, provided there is already knowledge of the DHCP protocol. This daemon needed to be installed via a script as it did not come pre-installed with Netkit-NG. There is a daemon already installed on Netkit-NG that is capable of handling DHCP, dnsmasq (see Section 3.4.7).

3.4.6. Domain Name System (DNS) Server

Bind9 was implemented as the DNS server for the network. This server comes installed on Netkit-NG so there was no need to install this on start-up. Rather that utilising standard DNS, where each device would have to be manually configured within the chosen daemon, the network uses Dynamic DNS (DDNS). DDNS allows for address assignment as nodes appear on the network. It also allows devices with non static IP addresses to be assigned host names and communicate. This feature reduces the need for remembering a large number of IP addresses.

3.4.7. Critical Analysis

Although most of the services described in the literature are available in the designed network, some were not included. SFTP is not available to the network. This was due to difficulties in its initial setup. It was possible to configure an HTTPS server which uses technology similar SFTP it was more difficult to implement this with ProFTPD.

As mentioned in Section 3.4.5 the DHCP daemon native to Netkit-NG was not used. ISC-DHCP-Server was chosen over dnsmasq as it requires less configuration to enable DDNS whilst using separate DHCP and DNS servers. Using separate DHCP and DNS servers offers users more options when using the network as they can choose not to use the DNS server entirely, this was an option not found when using dnsmasq. ISC-DHCP-Server also works slightly better with the ISC-DHCP-Relay daemons utilised in the routers in collision domain D.

4. Network Traffic Replay

This section gives an overview of how network traffic was produced and replayed across the network. Once the network was built, network traffic could then be produced. This traffic would then be captured and used to create white traffic on the network. This is done to make it more difficult to distinguish normal network traffic from that of a threat actor.

4.1. Creation of Network Traffic

Creating network traffic involved using the servers created previously (see Section 3). These services were used on the remote nodes, as they are designed to mimic a non-server device which would use the available services. Creating network traffic involved using the various services available on the network. For example, to generate email traffic, several emails were sent using the remote nodes (see Section 3.3). This process was repeated in a similar manner for FTP, SFTP, SSH, HTTP, and HTTPS in that the services were simply used to generate the traffic. The DHCP service will automatically function when it is needed by the network, as this is one of its key functions. Equally, the DNS service would be used as required by the network, and when such traffic was produced for DNS as the above services were used. Similar to the DNS service, the routers direct traffic based on network usage and, as such, were used in the production of traffic.

As well as producing network traffic from the services available to the constructed network, traffic was also produced using websites available on the internet. This utilised the tap node (see Section 3.1). This traffic was generated by using the Links web browser to browse the internet. Several websites were selected to browse and these were selected based on several criteria. The first criteria was where they ranked in three different websites that list most used websites, these lists are generated by alexa.com, moz.com, and similarweb.com (n.d.). Three different lists were used as each claim to use several techniques to gather website usage data. The second criteria was whether log in credentials were required to access the website. This simply ensures that no private details would appear when the traffic was captured. The final criteria was whether the website could be displayed properly in the Links browser. Links is a text based browser and as such is not capable of displaying images and other more advanced web features. If a website met these criteria, it was cross-examined against the other lists. The websites selected were amazon.com, google.com, reddit.com, and wikepedia.com. To generate traffic, these websites were simply browsed, links were followed, and in some cases generic search terms were entered, if a website had that functionality.

4.2. Capture of Network Traffic

The tool used to capture the network traffic was tcpdump. This tool was used as it is able to capture all network traffic going to and from a node to a file, in the PCAP format and is included in the Netkit-NG software. The traffic was produced by the remote nodes (see Section 3.3) and captured on the router nodes as these nodes are used whenever the remote nodes communicate with the wider network (see Section 3.2). Separate files were produced based on the service used. For example email traffic has been stored in a file called email1.pcap. This was done so that traffic could be replayed at random intervals. Several files were produced for each service. This meant that the services could be used differently. For example two FTP files were produced, the first contains traffic of the remote node sending a file to the FTP server, and the second contains traffic of the remote node pulling a file from the FTP server. Again this was done to allow for some level of unpredictability when the traffic is replayed.

4.3. Traffic Replay

For replaying network traffic, tool TCPReplay was used (see Section 2.4). This tool allows the editing of captured traffic which was required to make traffic look as though it is being created by a legitimate source, this is what is meant by white traffic. After editing the traffic it could then be replayed. Several bash scripts were created which perform randomization of traffic function. These scripts ensure that a random traffic capture file is replayed at random intervals in the space of one hour. This time frame can be altered if required. The capture and replay of traffic was a relatively simple procedure with few complications. The decision to utilise the available services allows a wider range of traffic to be produced by the network which would help to obscure any malicious traffic.

5. Program Overview

This section presents the various aspects of the program created to give users the ability to create a network environment to their own specification. This program was developed in the Python programming language as it offers the required functionality and can do so in an uncomplicated manner.

The user interface is a Command Line Interface (CLI). When the program is started, it prints basic information about the tool and then asks the user a series of questions regarding the network configuration they would like produced, such as how many instances of a particular node they would like Figure 2, shows the program in use and the questions asked.

There is room for improvement in the user interface as this program uses a CLI. While the program works without issue, the interface used is not as easy to use as a Graphical User Interface (GUI), which would offer a better display of the various options available to the user. The method used to garner the users subnet choice is also an area that could be improved.

6. Discussion

Research was conducted into common network services and cyber defence exercises in the literature review. A networked system was planned and created (see Section 3), this network can also be configured to a users specifications (see Section 5) which gives multiple learning opportunities in the practical implementation of networks and programming. The creation of the network puts into practice the services researched in the literature review. Extensive tests have been implemented. These tests are used to test that the functions work as described (see Appendix B).

Following the work conducted, there are aspects that could be improved or added. Adding features to the system could offer a better user experience. It could also give the system a wider user audience. The ability to emulate hostile traffic being one of them. This would increase the functionality of the system and allow a single team to conduct a cyber defence exercise rather than a red and blue team. Another feature that could be added is a graphical user interface (GUI). A GUI would make the program much easier to use. The command line interface (CLI) is useable, however, on a large network it would be tedious to configure the subnet for each device individually. A GUI could also offer a network diagram while the user is creating the network which would make their configuration much easier to visualise. Adding the ability to choose from a range of server daemons would also be a useful feature for the network creation program. This may be useful as different daemons might present different vulnerabilities or may react differently to different attack types. More research would have to be conducted in this area to gain a better understanding of how different daemons operate.

Currently, it is possible to use the program to create more nodes on a given subnet than is possible to address, the maximum being two-hundred and fifty-five. Doing so would likely create problems within the network. The improvement would involve a calculation to check how many nodes are already assigned to a subnet and then give an error message if a user attempts to add more than two-hundred and fifty-five. Improving the way the DNS and DHCP servers function would also be desirable. Currently the DNS and DHCP servers have to be on the same subnet; if they are not, the DNS server will not function correctly. It would be useful if this was not the case as it would allow more user configuration. Implementing this would require changes to the program to make this option configurable, it would likely also require a reconfiguration of the two servers to allow them to communicate from separate subnets. More research would be required to make this improvement as it may not be possible to implement this.

This article describes the procedure of creating an emulated network containing various services. The produced tool is capable of mimicking network traffic produced by normal usage of network services, also known as white traffic, in an attempt to obfuscate any malicious network traffic that might be produced in a cyber defence exercise. The environment that is presented on this paper is the basis for feature development of a fully automated cyber defence environment that can be used for training. In this environment we will integrate already deployed IDS systems [34] in order to facilitate automatic detection of attackers. Also the datasets that will be collected will be publicly available for helping other scholars conduct research on cyber security.