PHASE: Machine Learning Framework for Passive Human Activity Simulation Evaluation
The PHASE (Passive Human Activity Simulation Evaluation) framework, a new development in machine learning, is designed to evaluate how accurately synthetic user personas mimic real behaviors in cybersecurity simulations. As outlined in a paper on arXiv (2507.13505), it examines Zeek connection logs and can differentiate between human and non-human actions with more than 90% accuracy. Operating completely passively, PHASE uses standard network monitoring techniques, avoiding any user-side instrumentation or visible surveillance. Network data for machine learning is gathered through a Zeek network appliance to prevent the introduction of unnecessary traffic. Additionally, the paper introduces an innovative labeling method utilizing local DNS records for traffic classification, which eliminates the need for manual labeling and addresses the gap in quantitative evaluation methods for synthetic personas in cyber environments.
Key facts
- PHASE is a machine learning framework for evaluating synthetic user personas.
- It analyzes Zeek connection logs to distinguish human from non-human activity.
- The framework achieves over 90% accuracy.
- PHASE operates passively, using standard network monitoring.
- No user-side instrumentation or visible surveillance signs are required.
- Network activity is collected via a Zeek network appliance.
- A novel labeling approach uses local DNS records to classify traffic.
- The paper is available on arXiv with ID 2507.13505.
Entities
Institutions
- arXiv