Creation of realistic benign behavior for cyber range VM clients with ML methods

Research topic/area

Agentic AI, Security

Type of thesis

Bachelor / Master

Start time

08.12.2025

Application deadline

01.01.2027

Duration of the thesis

4-6 Months

Description

To detect attacks from advanced persistent threats (APT), researchers require data of such attacks to analyse them and subsequently develop detection methods. The mulation and recording of realistic APT attacks requires a flexible infrastructure to accommodate for the changing needs of different APT attack scenarios.

Our cyber range, working title attack range open stack (AROS), is such a flexible infrastructure. Using Ansible, Terraform and OpenStack, we are able to provision and setup code-defined infrastructures in an automated and repeatable manner. With our cyber range, we implement and recreate known APT attacks to create datasets and research APT attacks and detection approaches. For this, we create a target infrastructure and execute a real cyber attack, which is then recorded thoroughly.

What we need is a method to automatically generate realistic, normal / benign behavior for all our hosts. The generated behavior has to feature a significant variance, so learning algorithms cannot easily detect our benign behavior as a repeating pattern. It has to manifest in network communication and OS logs and system calls. This can be usual office PC uses, web browsing, etc.

See https://www.iai.kit.edu/english/973_5561.php for the full thesis announcement including figures.

Main Tasks:
• Evaluate different methods to create benign behavior
• Evaluate the use of ML and AI agents
• Create working prototype to generate live benign behavior in VMs with a given profile and time constraint or until stopped
• Ensure the prototype works with our cyber range
• Evaluate your work against other solutions

What we offer:
• Possibility of contributing to scientific publications
• Close supervision
• Thesis in English or German possible
• Opportunity to work with machine learning models and research data
• Student assistant position or familiarisation period possible

Requirement

Requirements for students

• Studies in Computer Science or adjacent
• Basic understanding of machine learning
• Basic knowledge of operating systems, system calls and network traffic

Faculty departments

• Engineering sciences
  Informatics

Supervision

Title, first name, last name

Richard Rudolph

Organizational unit

Institut für Automation und angewandte Informatik (IAI)

Email address

richard.rudolph@kit.edu

Link to personal homepage/personal page

Website

Application via email

Application documents

• Cover letter
• Curriculum vitae
• Grade transcript

E-Mail Address for application
Senden Sie die oben genannten Bewerbungsunterlagen bitte per Mail an richard.rudolph@kit.edu


Back