Can LLM Agents Simulate Dynamic Networks? A Case Study on Email Networks with Phishing Synthesis

TL;DR

This paper enhances LLM multi-agent systems to better simulate realistic dynamic networks, especially for cybersecurity applications like phishing, by integrating data-driven triggers and Hawkes processes.

Contribution

Introduces two extensions to LLM-based network simulations that preserve macroscopic network structures and dynamics, enabling more realistic modeling of evolving communication networks.

Findings

LLM agents can generate micro-level interactions plausibly.

The extensions improve the simulation of network topologies and temporal dynamics.

Framework effectively synthesizes realistic phishing campaigns.

Abstract

While Large Language Model (LLM) multi-agent systems (MAS) offer a transformative approach to simulating human behavior in complex systems, it remains largely unexplored whether these simulations can replicate realistic structural and temporal dynamics from a dynamic network perspective. Our evaluation indicates that existing frameworks excel at generating plausible micro-level interactions but fail to capture the emergent, macroscopic topologies necessary for domains that rely on realistic network dynamics, such as modeling information propagation and cybersecurity threats. To bridge this gap, we introduce two easily integrable extensions to simulation frameworks to ensure they preserve macroscopic network fidelity: 1) augmenting LLM agents with data-driven event triggers to organically sustain long-horizon interactions, and 2) integrating Hawkes processes to accurately model temporal activation dynamics. Our approach allows LLM MAS to capture both plausible micro-level patterns and macroscopic topologies. We further demonstrate the utility of this framework in synthesizing realistic phishing campaigns within evolving communication networks. The study reveals how threats exploit structural vulnerabilities, highlighting the potential of our framework for developing next-generation defenses. Our code is available at https://github.com/Graph-COM/NSL.