Design and implementation of a new cyber attack simulator for cyber security analysis

The fact that institutions and people have to deal with their work with information technologies has also brought risks and threats. Cyber attacks can have consequences that are difficult to recover. Although many intrusion detection and security systems have been developed against these attacks, attacks and security breaches against information systems are increasing rapidly. In this thesis, it is aimed to understand security vulnerabilities, which is one of the important issues in terms of cyber security, and to detect cyber attacks. Using real networks for cyber attack test runs is very costly and time consuming. In this thesis, a cyber attack simulation model has been developed using the DEVS modeling approach to simulate cyber attack scenarios, test the attacks and observe the results.. The attack simulation was carried out by using the developed visual interfaces, in which the parameters and configuration settings of the attack scenarios were made according to the characteristics of the attack modes. A simulation and monitoring framework was used to observe and evaluate the effects and consequences of attack steps. An application has been developed that simulates attack scenarios on a simulated network and evaluates these warnings by generating appropriate attack alerts. In this study, a method similar to the methodology of intrusion detection systems, in which network traffic is examined for intrusion prevention and "reflex" type actions are performed when suspicious activity is detected, is developed. CSE-CIC-IDS2018 dataset was used to test the system. DEVS-Suite simulation package was used as application development environment. The developed cyber attack simulator has been compared with other cyber attack simulation applications and its different aspects have been revealed. Although this cyberattack simulator is used to obtain alert data for certain types of attacks, it provides an extensible infrastructure to generate alert data for more different types of attacks in future studies. In this study, it has been seen that large-scale corporate networks can be designed easily and cyber security tests can be carried out in a short time.