GHOSTFIELD: A realistic integrated cyber information warfare simulation for joint live, virtual constructive exercises

We propose to develop GHOSTFIELD: a robust framework for hybrid information warfare simulation at scale.áUsing a combination of AI enabled Network Science and empirical validation GHOSTFIELD will enable planners to develop scenarios in less than a month along with all exercise control, empirically validated realistic cyber-attack sequences, personae, media and social media data at scale; white cells to provide seamless adjudication at scale, and trainees to train as they fight, in a multi-modality integrated cyber environment with automated adaptive BlueFor and adversarial response that is generable in 8-10 hours max. GHOSTFIELD is designed to be interoperable with other cyber environment systems, cyber simulation systems, áand analytic tools. Parts of GHOSTFIELD, such as many of the authoring and decision aids, will have both operational and training utility as they will be usable in either context to support mission relevant tasks such as content creation, analysis, and course of action evaluation.GHOSTFIELD will be informed by a database of cyberattacks and hybrid cyberattacks coded in terms of what MITRE ATT&CK techniques were used in operationalizing the CyberBEND information maneuvers, a database of media and social media campaigns, and a detailed case study.á This data will be used by the GHOSTFIELD simulation system to generate synthetic material for the scenario, such as that needed to indicate an impending cyber-attack, to attribute attacks to particular actors, to stage the attack including its potential severity and length, to mislead the public about the attack through adversarial propaganda, and the directives in terms of what systems are attacked, locations, actors, likelihood of success, and so forth thus providing input to existing cyber simulation tools. In addition, that data will be used in a validation system that assesses whether the synthetic data conforms to the scenario, is representative of real-world data on multiple levels ľ content, pattern of life, and network features. The real and synthesized data will be coded in terms of an integrated cyber framework comprised of CyberBEND maneuvers operationalized in terms of MITRE ATT&CK and media attack techniques each with associated network science metrics that can be used to identify the red flags that suggest cyber adversaries are active and coordinating.á The feasibility of developing GHOSTFIELD as an AI enabled network science system that employs multiple large language models, auto-prompt regeneration, data corpora for retrieval-augmented generation copra, with embedded statistical validation will be assessed and a baseline system developed. GHOSTFIELD authoring tools for planners, trainees and the white cell based on story directed large language models will be tested.á Generative models with structured prompts and semantic reranking will be tested for enabling the scenario creator to generate direct input to the cyber simulation systems.