Microsoft announced a cyberattack simulator designed to enable security researchers to create simulated network environments in order to observe the interactions between automated Artificial Intelligence (AI)-driven attackers and defenders.
The simulator called CyberBattleSim, is available under an open source license and relies on the Python-based Open AI Gym toolkit to train the automated agents based on reinforcement learning algorithms. The CyberBattleSim helps researchers observe and understand how a threat actor laterally spreads through a network after its initial compromise. The simulator is part of Microsoft’s efforts to use AI and machine learning in its battle against adversaries.
Security researchers can use the open sourced simulator to create a network with several nodes along with their running services, their vulnerabilities, as well as the security mechanisms on individual nodes.
The simulator tasks the automated attackers to take ownership of as much of the network by exploiting the vulnerabilities of the nodes. Similarly, automated defenders are designed to detect the presence of the attackers and eject them from the network in order to contain the attack.
