User Simulation for Cyber Ranges

• User Simulation is the generation of believable, system-level human activity on enterprise endpoints, crucial for realistic cyber ranges and security evaluations.
• It employs a hybrid architecture that combines deterministic control for core actions with selective learned modules for adaptive visual and text processing.
• The framework addresses realism challenges by synthesizing plausible interaction traces, organizationally coherent behavior, and nominal activity noise to enhance system evaluation.

Realistic simulation of users for IT systems in cyber ranges is the generation of believable, system-level human activity on enterprise endpoints so that cyber ranges, honeynets, malware-analysis environments, and security-monitoring evaluations no longer operate over obviously empty or artificial machines. In this setting, realism is not limited to GUI automation or synthetic text alone: it includes visible interaction traces, plausible documents and email, organizationally coherent behavior, and enough nominal activity to approximate the noise floor of real enterprise life. The core contribution of "Realistic simulation of users for IT systems in cyber ranges" is a hybrid architecture in which deterministic control handles most of the runtime loop, while learned modules are used selectively for visual classification and conditional text generation (Dey et al., 2021).

1. Problem setting and rationale

The paper addresses an underexplored gap in cyber-range and security-evaluation environments: many platforms can deploy hosts, services, and attacks, but they do not generate the dense background of legitimate user activity that makes an information system look and behave like a real enterprise. This absence matters in at least three settings. In cyber ranges, realism affects immersion and training value. In honeynets and malware detonation platforms, empty or obviously unused machines can signal artificiality to adversaries and malware. In security monitoring and machine-learning evaluation, the lack of realistic benign activity yields biased telemetry and impoverished baselines for anomaly detection (Dey et al., 2021).

The paper makes this argument concrete by pointing to artifacts and behaviors that malware may inspect, including cookies, recycle-bin content, browser history, mouse dynamics, and user-triggered interactions such as scrolling a Word document. It also emphasizes that realistic nominal activity should include borderline but legitimate behaviors, such as scans, USB insertions, or administrative mistakes, because these are precisely the forms of noise against which monitoring systems must operate (Dey et al., 2021).

This focus aligns with a broader distinction in user-simulation research between simulation for training and simulation for evaluation. In conversational information access, training-oriented simulators aim to maximize behavioral similarity to real users, whereas evaluation-oriented simulators aim to predict real-world system performance (Bernard et al., 2024). More recent work on agentic tasks similarly warns that simulated users can create an "easy mode" by being excessively cooperative, stylistically uniform, and insufficiently frustrated, thereby inflating system success relative to human baselines (Zhou et al., 11 Mar 2026). In the cyber-range context, this suggests that realism is not merely cosmetic; it is an evaluative requirement.

2. External layered architecture

The proposed system is best understood as an external behavior-emulation and scenario-generation framework for enterprise endpoints. Its core design principle is that endpoint instrumentation should be external to the instrumented machine whenever possible, in order to avoid leaving traces visible either to attackers or to endpoint monitoring tools. Rather than deploying an automation client inside every workstation, the framework drives a host through the same channels as a human user: keyboard, mouse, and screen (Dey et al., 2021).

The architecture is layered so that low-level actuation and sensing are separated from higher-level logic, improving maintainability, modularity, and portability across environments. For virtual machines, the paper considers QEMU Monitor APIs and VNC connections; for physical machines, it discusses sending keyboard and mouse actions over USB HID while capturing video output externally. This abstraction is presented as an improvement over prior solutions tied to a specific hypervisor or remote-display mechanism, with the explicit goal of portability across virtualization stacks such as VMware ESXi or Proxmox, and conceptually to physical systems as well (Dey et al., 2021).

Layer	Function	Illustrative elements
Physical interaction primitives	External actuation and observation	keyboard, mouse, screen capture
Interaction layer	Adapt tasks to environment-specific UIs	Thunderbird, Outlook
Action API	Reusable unit actions	open browser, web search, read/write email
Scenario layer	User-life specification	user-life scenarios, life scenarios

The interaction layer hides environment-specific UI differences from the scenario author. A high-level task such as sending an email is functionally similar across clients like Thunderbird and Outlook, yet the targets and UI steps differ enough to require environment-specific handling. Above that, the action API exposes unit actions such as opening a browser, performing a web search, identifying links in a page, reading and writing email, and handling word-processing tasks. User-life scenarios are then expressed in terms of these unit actions (Dey et al., 2021).

This architecture is explicitly not an end-to-end learned user simulator. Deterministic or rule-based control carries most of the burden of runtime correctness and efficiency; deep learning is introduced only where the deterministic stack is weakest (Dey et al., 2021).

3. Runtime adaptation, visual perception, and motor realism

A central requirement is real-time adaptation. The agent executes preplanned scenarios while reacting to runtime randomness: windows can appear in different places, popups can interrupt the flow, systems can stop unexpectedly, and software versions can render controls differently. To handle this, the framework continuously inspects the screen and infers what is present and where (Dey et al., 2021).

The paper’s screen-analysis pipeline is hybrid. Template matching is used when a UI element varies little within a given environment, since it is cheap and deterministic, though brittle under changes such as resolution or color variation. When template matching is insufficient, the system avoids heavyweight object detectors such as Faster R-CNN, SSD, or YOLO for full-screen detection, arguing that they are too computationally expensive for scaling to many instrumented machines and that no suitable public screenshot-annotation dataset exists. Instead, screenshots are processed with adaptive thresholding and geometric filtering so that candidate regions can be isolated using rules such as aspect-ratio expectations; only then do convolutional neural networks reject false positives and classify the remaining candidates (Dey et al., 2021).

OCR is the third visual technique. The implementation uses Tesseract to read interface text such as labels, menu items, file names, and folder names, and reuses the desker method for recognizing links in web pages. This allows the agent to navigate by semantics rather than only by appearance, which is crucial when fixed coordinates or simple icon matching are unreliable (Dey et al., 2021).

The action layer is similarly hybrid, but in a different sense: it is procedural rather than learned. Mouse movement is decomposed into many small submovements with velocity dependent on travel distance; random perturbations and inertia are added to avoid straight, overly precise, or instantaneous cursor paths. Keystrokes are separated by random delays, and idle mouse movements are added during waiting periods. These randomized procedural models are intended to defeat simple anti-sandbox checks and increase behavioral plausibility, but the paper explicitly notes that there is no learned model of motor control or long-horizon action policy (Dey et al., 2021).

This design choice differentiates the framework from many later LLM-based user simulators. In task-oriented dialogue, for example, DAUS is an LLM-based utterance generator conditioned on a natural-language goal and dialogue history (Sekulić et al., 2024); in interactive search, UXSim uses an orchestration policy over grounded traditional modules and LLM-based cognitive functions (Zerhoudi et al., 27 Feb 2026). By contrast, the cyber-range system remains firmly rooted in external GUI actuation plus lightweight adaptive perception.

4. Life scenarios, avatars, and generated content

The paper extends beyond local GUI automation to the notion of life scenarios spanning an entire information system. Here the central concept is coherence. Simulated users are represented as avatars embedded in a relational graph containing users, projects, workgroups, and interpersonal relation types such as friendship, supplier-customer links, partnership, and hierarchy. Scenario templates are generated from this graph, so that role, project membership, and social relation shape what users do and how they communicate (Dey et al., 2021).

This graph-based view supplies temporal, social, organizational, and task-level structure. A developer should use a code editor more often than a manager; coworkers who are also friends may exchange more informal emails; communication style may differ when addressing a partner or a client. The paper presents an orchestrator overview figure, but also states that full multi-agent orchestration across a networked enterprise is not yet treated in depth. The contribution is therefore an architectural direction and scenario-modeling sketch rather than a complete distributed scheduler (Dey et al., 2021).

The main deep-learning contribution beyond CNN-based visual classification is conditional text generation. To make user activity believable, the system must generate not only clicks and windows but also realistic documents, emails, and conversations. Manual authoring of this material for dozens of avatars is laborious, so the paper fine-tunes GPT-2 for conditional text generation. The conditioning context includes tone and communicative situation—for example formal versus informal, partner versus client—together with target topics such as subject and keywords. Training uses 35,000 open-source emails, each associated with keywords, a polarity label, and a tone label (Dey et al., 2021).

The text-generation pipeline is algorithmic rather than mathematical: define the avatar and scenario context; build a conditioning prefix; feed the prefix to the fine-tuned GPT-2 model; sample candidate continuations; and use those candidates as realistic emails or drafts for light operator editing. Coherence is maintained primarily by conditioning and by the avatar graph, not by an explicit memory model or discourse-state tracker (Dey et al., 2021).

This mechanism is narrower than later user-simulation architectures built around richer memory or goal tracking. SimSpark, for example, combines daily plans, perceptions, memory retrieval, and reason/decide modules to simulate post, like, follow, and reply behavior on a text-only social platform (Lin et al., 17 Jun 2025). USP, in open-ended human–LLM dialogue, infers implicit profiles from conversations and then optimizes simulation through conditional supervised fine-tuning plus reinforcement learning with cycle consistency (Wang et al., 26 Feb 2025). The cyber-range framework instead uses GPT-2 surgically, as a content-realism module within a predominantly deterministic system (Dey et al., 2021).

5. Portability, maintenance tooling, and empirical limits

One of the strongest implementation-focused aspects of the paper is its adaptation workflow for new operating systems, software versions, and environments. The authors include an action-recording tool that captures raw mouse movements, clicks, keyboard events, and screenshots while a human performs a task. These recordings are aggregated and segmented into small actions. The tool then extracts visual target regions either by comparing screenshots around a click event or by reusing the candidate-zone identification pipeline to accelerate screenshot annotation for the visual models (Dey et al., 2021).

This recorder functions as a portability and maintenance mechanism: when cookie popups appear, a major software update changes the UI, or a new application variant must be supported, existing actions can be adapted in minutes. The paper therefore treats portability not as a one-time engineering property but as an ongoing maintenance problem managed through reusable tooling (Dey et al., 2021).

The framework nevertheless makes strong deployment assumptions. It assumes access to external control and observation channels such as hypervisor APIs, VNC-like framebuffers, or physical I/O emulation plus video capture. It assumes that applications are GUI-driven and visually inspectable. It assumes that environments can be recognized from screenshots and that software variation can be managed by updated templates, retrained classifiers, or recorded action adaptations. It also assumes nontrivial scenario-authoring effort up front: avatars, roles, relationships, and communication keywords must be specified (Dey et al., 2021).

Evaluation remains partial. For text generation, the main reported result is that after training on 35,000 emails, only about 20% of generated outputs are usable with minor modifications. For the action agent, the paper does not report formal realism studies, Turing-test-like evaluations, end-to-end latency numbers, throughput per host, GPU or CPU usage, or comparative benchmarks against YOLO, SSD, or prior BEEZH implementations. The conclusion states that the early results are encouraging but still need consolidation before full experimental validation (Dey et al., 2021).

These limitations resonate with later work on simulation realism. The realsim framework argues that realism should be assessed distributionally and across multiple dimensions rather than through coarse judgments on isolated dialogues (Liu et al., 4 May 2026). The proposed verifiable framework for search and recommendation systems similarly treats simulation as an auditable artifact composed of Persona, Contract, Execution, Trace, Verification, Feedback, and Refinement (Ma et al., 12 Jun 2026). In multi-turn agentic evaluation, the Sim2Real literature further shows that LLM simulators often remain excessively cooperative and evaluatively lenient relative to humans (Zhou et al., 11 Mar 2026). These results suggest that the cyber-range framework’s methodological candor about incomplete validation is a substantive part of its contribution.

6. Position within the broader user-simulation landscape

The paper explicitly situates itself between GUI behavior emulation, workload generation, and synthetic persona-driven simulation with a natural-language generation layer. It is not a pure agent-based cognitive simulator, not a traffic-only workload generator, and not an autonomous desktop user driven by an LLM. Its novelty lies in integrating external desktop control, lightweight adaptive vision, procedural realism, and conditional text generation into a portable framework for cyber ranges and security evaluation (Dey et al., 2021).

Across the broader literature, user simulation appears in several distinct but related roles. In task-oriented dialogue, DAUS shows that domain-aware fine-tuning of an LLM on goal-conditioned conversations improves user goal fulfillment and reduces hallucinations relative to prompt-only simulation (Sekulić et al., 2024). In conversational recommender systems, user simulation has been used both as an iterative debugging instrument for conversational breakdowns (Bernard et al., 2024) and as a black-box evaluation toolkit built around agenda-based control, persona, context, and conditional NLG (Afzali et al., 2023). In social media, SimSpark uses configurable personas, event timelines, memory-based reasoning, and interactive visualization to simulate post, reply, like, and follow behavior (Lin et al., 17 Jun 2025). In web marketing, CXSimulator models user trajectories as transitions on an event graph and uses LLM embeddings to generalize to unseen campaign events (Kasuga et al., 2024). In recommender-system onboarding, simulation is coupled to production infrastructure so that candidate preference-elicitation policies can be screened offline before live deployment (Hsu et al., 2024). In interactive search, UXSim combines grounded traditional simulators with LLM-based cognition through an orchestration policy over a structured state (Zerhoudi et al., 27 Feb 2026).

Within that landscape, the cyber-range system remains distinctive because its realism target is the lived-in enterprise endpoint. Its behavioral outputs are not merely dialogue turns, queries, or clicks in a platform log; they are visible desktop actions, human-like cursor dynamics, realistic emails and documents, and socially coherent enterprise artifacts. A plausible implication is that this work occupies a boundary zone between classical user simulation and deception-resistant environment synthesis: it attempts to make an IT system look used, inhabited, and organizationally consistent under both human inspection and simplistic automated anti-sandbox checks (Dey et al., 2021).

The paper also points toward enduring open problems. Full orchestration among multiple agents is not solved. Long-horizon persona consistency, document lifecycle evolution, recurring habits, and cross-day routines remain largely manual. Domain shift across operating systems, themes, languages, and enterprise workflows may still degrade performance. And because the framework can generate realistic organizational communication and behavioral traces, there is an implicit dual-use risk. Those limitations do not weaken the main result; they define the field’s next questions (Dey et al., 2021).