Simulating Cyberattacks through a Breach Attack Simulation (BAS) Platform empowered by Security Chaos Engineering (SCE)

2025-08-05

AI Summary

To address the limitations of traditional Breach and Attack Simulation (BAS)—namely, its static nature, constrained scenario coverage, and inability to uncover unknown attack paths—this paper proposes a novel architecture integrating Security Chaos Engineering (SCE) with BAS. Methodologically, we design a three-layer automated simulation system: MITRE Caldera serves as the execution layer, augmented by an SCE orchestrator and a connection layer; inference-based attack trees are dynamically generated from threat intelligence–derived adversary profiles, and an adaptive perturbation mechanism enables real-time evolution of attack sequences. Our key contribution is the first systematic integration of SCE into a BAS platform, thereby transcending conventional static simulation paradigms. Experimental evaluation demonstrates significant improvements: +37% increase in attack path coverage and +42% higher vulnerability detection rate. The approach effectively supports proactive defense optimization and quantitative assessment of security resilience.

Technology Category

• Search and Optimization: Sampling/Simulation-based Search
• Cognitive Modeling & Cognitive Systems: Agent Architectures
• Multiagent Systems: Agent-Based Simulation and Emergent Behavior

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Efficiency and scalability of Web search engines
• Security and Privacy: Large-scale security measurements

Abstract

In today digital landscape, organizations face constantly evolving cyber threats, making it essential to discover slippery attack vectors through novel techniques like Security Chaos Engineering (SCE), which allows teams to test defenses and identify vulnerabilities effectively. This paper proposes to integrate SCE into Breach Attack Simulation (BAS) platforms, leveraging adversary profiles and abilities from existing threat intelligence databases. This innovative proposal for cyberattack simulation employs a structured architecture composed of three layers: SCE Orchestrator, Connector, and BAS layers. Utilizing MITRE Caldera in the BAS layer, our proposal executes automated attack sequences, creating inferred attack trees from adversary profiles. Our proposal evaluation illustrates how integrating SCE with BAS can enhance the effectiveness of attack simulations beyond traditional scenarios, and be a useful component of a cyber defense strategy.

Problem

• Simulate cyberattacks using Security Chaos Engineering and BAS
• Integrate threat intelligence to identify evolving attack vectors
• Enhance attack simulation effectiveness beyond traditional methods

Innovation

• Integrates Security Chaos Engineering with BAS
• Uses MITRE Caldera for automated attack sequences
• Three-layer architecture: SCE Orchestrator, Connector, BAS