Toward Effective Evaluation of Cyber Defense Threat Based Adversary Emulation Approach. Shakas Technologies ( Galaxy of Knowledge) #11/A 2nd East Main Road, Gandhi Nagar, Vellore - 632006. Mobile : +91-9500218218 / 8220150373| land line- 0416- 3552723 Shakas Training & Development | Shakas Sales & Services | Shakas Educational Trust|IEEE projects | Research & Development | Journal Publication | Email : info@shakastech.com | shakastech@gmail.com | website: www.shakastech.com​ Facebook: https://www.facebook.com/pages/Shakas-Technologies

1. Base paper Title: Toward Effective Evaluation of Cyber Defense: Threat Based Adversary
Emulation Approach
Modified Title: Towards an Effective Cyber Defence Evaluation: A Threat-Based Adversary
Emulation Method
Abstract
Attackers compromise organizations with increasingly sophisticated ways, such as
Advanced Persistent Threat (APT) attackers. Usually, such attacks have the intention to exploit
endpoints to gain access to critical data. For security controls and defense evaluation,
organizations may employ offensive security activities. The most important one is penetration
testing and red teaming, but such operations are usually resource exhaustive and extend over a
longer period of time. Furthermore, traditional Venerability Assessment and Penetration
Testing (VAPT) works effectively in the mitigation of known attacks but did not prove to be
effective against stealthy attacks. VAPT considers the whole offsec as an acting problem but
in reality, an attacker has to deal with uncertainty while conducting real-world attacks. In this
paper, we are presenting an adversary emulation approach based on MITRE ATT&CK
adversary emulation plan with consideration of planning as a major part of each attack phase.
The approach utilizes stealthy attack vectors and paths to emulate adversary for defense
evaluation. For effective defense evaluation, we picked more than 40 techniques from
ATT&CK, deployed their mitigation on target machines, and then launched attacks against all
those techniques. We show that attack paths and payloads generated using our approach are
strong enough to evade security controls at endpoints. This approach provides a special
environment for cyber defenders to think like adversary, and create new attack vectors and
paths to evaluate organizational security preparedness. This process constructs a special
environment to expand the attack landscape view and defense evaluation with minimal
resources for the organization.

2. Existing System
Threat of cyber attacks continues to increase as cybercriminals become more
sophisticated and organizations rely more heavily on technology. Recent stats show a drastic
increase in cyber-attacks targeting endpoints. Such as servers, cell phones, and workstations.
Endpoints are considered as the most valuable and vulnerable devices. One example is the use
of ‘‘business email compromise’’ (BEC) [1] attacks, in which attackers impersonate executives
or vendors to trick employees into providing sensitive information. Another example is the use
of ransomware, in which attackers encrypt a company’s data and demand a ransom payment to
restore access. The threat of cyber attacks continues to increase as cybercriminals become more
sophisticated and organizations rely more heavily on technology. Advancement of technology
has posed increased threats as the number of endpoint nodes are increasing so endpoints
security must be prioritized. Thus endpoint security is considered as the future of cybersecurity
[2]. Many organizations conduct penetration testing periodically to determine the presence of
potential vulnerabilities [3]. Such testing aims to evaluate the security controls adopted by the
organization. Sample penetration tools and methods are discussed in [4]. Usually, organizations
have adversary simulation teams on board to run these offensive activities as a ‘‘cat and
mouse’’ game. One team is responsible for launching attacks and the other team is responsible
for detecting them, that’s how they evaluate security. This proved to be an effective approach,
with one drawback: the red team’s operations are resource exhaustive. In a changing threat
landscape, where attackers are employing increasingly sophisticated attacks, organizations are
more prone to cyberattacks. Modern solutions, such as models for vulnerability scanning,
vulnerability management, vulnerability mitigation and Vulnerability Assessment and
Penetration Testing (VAPT), rely on ‘‘known threats’’, while we often see attackers exploiting
unknown and zero-day vulnerabilities. Recent solutions tried to alleviate this situation by
exploring control based evaluation [5], but this approach is still prone to zero days attacks.
Drawback in Existing System
 Resource Intensive:
Emulating sophisticated adversaries and their tactics, techniques, and procedures
(TTPs) requires significant resources. This includes skilled personnel, time, and
advanced tools. Organizations with limited resources may find it challenging to conduct
thorough threat-based adversary emulation.

3.  Difficulty in Realism:
Achieving true realism in threat emulation can be challenging. Adversarial tactics are
constantly evolving, and accurately mimicking the complexity and variability of real-
world attacks is difficult. This limitation may result in simulations that do not fully
represent the diversity of potential threats.
 Ethical Concerns:
Simulating realistic cyber threats may involve using techniques that resemble actual
attacks. This raises ethical concerns, as the emulation process could inadvertently cause
harm, disrupt operations, or compromise sensitive information. Striking the right
balance between realism and ethical considerations is crucial.
 Lack of Standardization:
There is a lack of standardization in threat emulation methodologies. Different
organizations may use varying approaches, making it challenging to compare
assessment results across different environments accurately.
Proposed System
 Objective Definition:
Clearly define the objectives of the TBAE system, including the scope of emulation,
specific threat scenarios, and key performance indicators (KPIs) for assessing the
effectiveness of cyber defenses.
 Scenario Generation Engine:
Implement a scenario generation engine that creates diverse and realistic attack
scenarios. This engine should consider the organization's infrastructure, industry-
specific threats, and potential attack vectors.

4.  Machine Learning for TTP Mimicry:
Incorporate machine learning algorithms to mimic adversary behavior. Train models
using historical attack data and continuously update them to reflect evolving TTPs. This
enables the emulation system to adapt to emerging threats.
 Behavioral Analysis Module:
Implement a behavioral analysis module to monitor and analyze system and network
behavior during the emulation. This module should include anomaly detection
algorithms to identify deviations from normal patterns.
Algorithm
 Machine Learning for Mimicking Adversarial Behavior:
Machine learning algorithms can be employed to model and mimic adversarial
behavior. This involves analyzing historical attack data, identifying patterns, and
training models to replicate the tactics used by real adversaries. Reinforcement learning
can be particularly useful in adapting the simulation based on the defender's responses.
 Red Team Automation:
Red teaming, a key component of threat-based emulation, involves simulating an
adversarial team attacking a system. Algorithms can automate certain red teaming tasks,
such as reconnaissance, weaponization, delivery, exploitation, installation, command
and control (C2), and actions on objectives (AoO).
 Evasion Techniques:
Algorithms can be used to implement evasion techniques to simulate advanced
adversaries trying to bypass detection mechanisms. This involves crafting malicious
payloads and using obfuscation methods to avoid detection by security tools.

5. Advantages
 Identification of Weaknesses:
By mimicking actual adversary behavior, this approach helps identify weaknesses and
vulnerabilities in the system that may not be apparent through traditional security
assessments. It allows organizations to understand how their defenses perform under
simulated attack scenarios.
 MITRE ATT&CK Framework Alignment:
The emulation approach often aligns with the MITRE ATT&CK (Adversarial
Tactics, Techniques, and Common Knowledge) framework, which provides a
comprehensive and structured matrix of adversarial tactics and techniques. This
alignment enhances the assessment's effectiveness and helps organizations focus on
specific threat behaviors.
 Red Team Collaboration:
Threat-based emulation often involves collaboration with red teaming activities. Red
teams simulate adversarial attacks, while blue teams defend against these attacks. This
collaborative approach fosters a deeper understanding of the organization's security
landscape and promotes a more effective defense strategy.
 Risk-Based Prioritization:
By focusing on realistic threat scenarios, organizations can prioritize security
measures based on the potential impact and likelihood of specific threats. This risk-
based approach allows for more efficient resource allocation and risk mitigation.
Software Specification
 Processor : I3 core processor
 Ram : 4 GB
 Hard disk : 500 GB
Software Specification
 Operating System : Windows 10 /11
 Frond End : Python

6.  Back End : Mysql Server
 IDE Tools : Pycharm