Automating the Generation of Cyber Range Virtual Scenarios with VSDL

TL;DR

This paper presents a framework that automates the creation and deployment of complex cyber range scenarios using a domain-specific language and SMT solvers, enhancing flexibility and reusability in cybersecurity training environments.

Contribution

The paper introduces VSDL, a domain-specific language for high-level cyber range scenario specification, and a method to automatically generate deployment scripts via SMT solving.

Findings

Successfully automates complex scenario deployment

Enables high-level scenario specification with constraints

Reduces manual effort in cyber range setup

Abstract

A cyber range is an environment used for training security experts and testing attack and defence tools and procedures. Usually, a cyber range simulates one or more critical infrastructures that attacking (red) and defending (blue) teams must compromise and protect, respectively. The infrastructure can be physically assembled, but much more convenient is to rely on the Infrastructure as a Service (IaaS) paradigm. Although some modern technologies support the IaaS, the design and deployment of scenarios of interest is mostly a manual operation. As a consequence, it is a common practice to have a cyber range hosting few (sometimes only one), consolidated scenarios. However, reusing the same scenario may significantly reduce the effectiveness of the training and testing sessions. In this paper, we propose a framework for automating the definition and deployment of arbitrarily complex cyber range scenarios. The framework relies on the virtual scenario description language (VSDL), i.e., a domain-specific language for defining high-level features of the desired infrastructure while hiding low-level details. The semantics of VSDL is given in terms of constraints that must be satisfied by the virtual infrastructure. These constraints are then submitted to an SMT solver for checking the satisfiability of the specification. If satisfiable, the specification gives rise to a model that is automatically converted to a set of deployment scripts to be submitted to the IaaS provider.