Modellering av användarbeteende och generering av syntetiska loggar i Meta Attack Language

The Meta Attack Language (MAL) is a formalism for threat modeling and simulating cyberattacks focusing on attacker perspectives [1]. However, understanding and modeling normal user behavior is essential for developing intrusion-detection systems (IDS) and for creating realistic testing environments. This thesis addresses how MAL can be used to simulate legitimate user activities by implementing a methodology to model user behavior and generate synthetic user logs that reflect realistic statistical distributions and patterns. User patterns and timestamps of activity are extracted from legitimate user logs and modeled using Markov chains. A domain-specific language (DSL) for user actions and system states is designed within the MAL framework. This user-DSL with Markov chain transition probabilities guides a user agent in navigating the system model and generating synthetic logs. The similarity of the generated synthetic logs was evaluated by comparing their transition patterns and timestamps with those in the original log data across three timeframes (one‐day, three‐day, and two‐week periods). Similarity was measured using Total Variation Distance (TVD), Jensen–Shannon Divergence (JSD), and Pearson Correlation. The results show that the synthetic logs closely replicate real user transition frequencies and hourly activity distributions, especially over more extended periods. In the best case scenario (the two-week comparison), the results show a Total Variation Distance (TVD) of 0.29, a Jensen–Shannon Divergence (JSD) of 0.18, and a Pearson Correlation of 0.99, indicating a strong match between synthetic and real user behavior in terms of both transition patterns and time activity. This work demonstrates MAL’s applicability for modeling user behavior, providing a way to generate realistic synthetic log data. Such data is valuable for training IDS, assessing security postures, and enhancing the realism of cybersecurity exercises. The results also highlight challenges in user-log analysis and offer an understanding of the practical use of MAL for user modeling.