Cyber Deception: BUDA Framework Automates Realistic User Behavior to Trap Attackers

Key Objectives

• Automate Deception Operations: Simulate human-like interactions to generate realistic activity traces.
• Enhance Credibility: Add value to decoys systems that closely mimic real user environments, making detection by adversaries more difficult.
• Integrate with Strategic Frameworks: Align operations with established guidelines to support robust cyber defense strategies.

Objets & Architecture Overview

BUDA framework is structured into several core components, each playing a vital role in the simulation and management of deceptive activities:

• Narratives: Define the operational scenarios and strategic context for deception.
• User Profiles: Manage realistic honeyuser identities.
• Activities Types: Define user-like actions to create authentic digital footprints.
• Context: Integrate real-world environmental data to support simulation accuracy.

How It Works

BUDA operates by simulating realistic user behaviors within a decoy environment to enhance cyber deception strategies. It achieves this through the orchestration of several key components working in concert.

The process begins by integrating real-world environmental data into BUDA through the Global Context. This involves uploading EVTX logs to extract information such as:

• Usernames
• IP addresses
• Device names

These details influence all aspects of activity creation and command execution. The Global Context serves as the foundation for generating realistic simulations.

Next, you define Narratives, which act as the strategic backbone of the deception operation. A narrative outlines:

• Operational goals (e.g., diverting attacks, enabling early detection)
• Simulated user profiles participating in the deception
• Attacker profile expectations
• Deception activities (fake resources)

By setting a similarity threshold, you can control how closely the simulated behavior mimics real user activity.

With a narrative in place, you configure User Profiles, representing simulated identities. These profiles mimic real users by defining attributes such as:

• Name and role
• Behavioral patterns (work hours, application usage)
• WinRM server details for executing activities

Profiles can be created manually or generated with Language Models (LLMs). Each profile is linked to one or more narratives, defining its role in deception operations.

BUDA then simulates user actions through Activities, creating a credible digital footprint. Activities are defined by:

• Action types (e.g., browsing, logins, file access)
• Action details (e.g., target file, URL)
• Assigned user profiles performing the activity

You can manually create custom activity sequences or use LLM-assisted generation to design effective deception strategies.

Throughout the process, BUDA leverages Language Models (LLMs) for realistic and contextually relevant data generation. You can configure the LLM provider (OpenAI or LM Studio) and the specific model in the BUDA settings.

Once narratives, user profiles, and activities are configured, BUDA executes the simulated actions. The resulting activity traces aim to:

• Create a realistic but deceptive environment
• Monitor interactions with decoy elements
• Achieve early detection of adversaries
• Divert attacker attention from real assets
• Calibrate and validate monitoring systems

Install & Use