Model-based authoring builds consistent virtual SOC training exercises
Original title: Model-Based Authoring of SOC Simulation Exercises for Cybersecurity Education
A phishing-to-ransomware reference package with eight events passed reference validation and runs in a Virtual SOC prototype.
The paper describes a model-based way to author virtual Security Operations Center exercises so alerts, evidence, timeline entries, learner tasks, and assessments stay consistent. An incident model of events, objects, and evidence is paired with an orchestration model, and an LLM writes selected scenario text from that specification. The method is implemented in a Virtual SOC prototype and tried on a phishing-to-ransomware reference exercise. GLM-5.3 alert descriptions are inserted, and a separate validator checks references, ordering, evidence links, assessment completeness, and fixed fields. The authors report true negatives on valid data and true positives on planted inconsistencies, and say the package runs in the learner environment.
- The reference model has eight incident events, eight objects, and six evidence items.
- It includes seven alerts in five batches and 13 timeline entries, 12 of them learner tasks.
- Five representative assessment items are included.
- GLM-5.3 generates the alert descriptions that are inserted into the model.
- A validator flags deliberately placed inconsistencies as true positives.
- Products
- Virtual SOC
- AI models
- GLM-5.3
From the original article
1 min read at arxiv.orgCybersecurity training and classroom exercises with a virtual Security Operations Center (SOC) combine alerts, evidence, timeline entries, learner tasks, and assessment items that must remain consistent across an evolving incident.
By Felix Härer · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.