Flexible Generation of Synthetic Attacks for Host Security Datasets

The attacks used in host security datasets today are dominated by red-team engagements, which are ad hoc in their coverage of malicious host behaviors (e.g., system calls) and tightly coupled to specific environments. As a result, they are difficult to port, parameterize, or regenerate, and provide no systematic coverage guarantees.

We propose the ERIS synthetic attack generation framework, an automated, MITRE ATT&CK killchain– and technique–driven approach that provides reproducible, environment-independent coverage of attacker behaviors. The system uses declarative attack specifications of killchains to generate realistic digital-twin attack scenarios, producing system- and process-level traces that are similar to real-world attacks without requiring exploit PoCs or handcrafted malware. This enables systematic, parameterizable generation of diverse attack behaviors with wide coverage over MITRE ATT&CK techniques. We compare the synthetic generation of attacks by ERIS to the successful attacks in the DARPA TC dataset finding 96% similarity to an attack on Firefox that can be produced repeatably on multiple platforms. Using ERIS, security researchers can automatically produce a variety of attack traces without complex and fragile exploit construction that can then be integrated into comprehensive datasets.