{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,11]],"date-time":"2026-06-11T09:15:20Z","timestamp":1781169320609,"version":"3.54.1"},"reference-count":87,"publisher":"SAGE Publications","issue":"12","license":[{"start":{"date-parts":[[2024,9,10]],"date-time":"2024-09-10T00:00:00Z","timestamp":1725926400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["SIMULATION"],"published-print":{"date-parts":[[2024,12]]},"abstract":"<jats:p>Cybersecurity is an urgent concern. Cybersecurity simulation is an important part of the response to it. This article describes a research program consisting of several interconnected cybersecurity simulation research projects. Cyberattacks are modeled using Petri nets extended with features designed for modeling cyberattacks, including representations of the attacker\u2019s and defender\u2019s strategies, their actions, and their actions\u2019 cost. A database of known attack patterns is automatically processed to generate cyberattack component models, one for each attack pattern. The models are verified and validated using multiple application-relevant methods that consider both Petri nets\u2019 theoretical properties and cyberattacks\u2019 practical characteristics. Because the source attack pattern database is attacker-centric, the cyberattack component models are enhanced to include defender actions and responses, as well as representations of normal user activities on the computer system being attacked. Cyberattack component models stored in a repository are selected and composed into complete models of target computer systems. Metadata associated with each model guides the selection and composition. The cyberattack models are executed to simulate cyberattacks. Multiple simulation iterations are used to train reinforcement learning algorithms that automatically learn improved attacker or defender strategies.<\/jats:p>","DOI":"10.1177\/00375497241268752","type":"journal-article","created":{"date-parts":[[2024,9,13]],"date-time":"2024-09-13T21:26:40Z","timestamp":1726262800000},"page":"1257-1280","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":3,"title":["Simulating cyberattacks with extended Petri nets"],"prefix":"10.1177","volume":"100","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9838-2016","authenticated-orcid":false,"given":"Mikel D","family":"Petty","sequence":"first","affiliation":[{"name":"Department of Computer Science, The University of Alabama in Huntsville, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"John A","family":"Bland","sequence":"additional","affiliation":[{"name":"Computer Engineering, The University of Alabama in Huntsville, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tymaine S","family":"Whitaker","sequence":"additional","affiliation":[{"name":"Department of Computer Science, The University of Alabama in Huntsville, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Walter Alan","family":"Cantrell","sequence":"additional","affiliation":[{"name":"College of Computing and Technology, Lipscomb University, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Katia P","family":"Maxwell","sequence":"additional","affiliation":[{"name":"Computer Science, Athens State University, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"C Daniel","family":"Colvett","sequence":"additional","affiliation":[{"name":"Department of Industrial and Systems Engineering, The University of Alabama in Huntsville, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"E Michael","family":"Bearss","sequence":"additional","affiliation":[{"name":"Trideum Corporation, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"179","published-online":{"date-parts":[[2024,9,10]]},"reference":[{"key":"bibr1-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/1548512917699724"},{"key":"bibr2-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/0037549714540221"},{"key":"bibr3-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/0037549716656060"},{"key":"bibr4-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/0037549710385716"},{"key":"bibr5-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/0037549716685874"},{"key":"bibr6-00375497241268752","volume-title":"Proceedings of the 2017 AlaSim international conference and exposition","author":"Whitaker TS"},{"key":"bibr7-00375497241268752","first-page":"110","volume-title":"Proceedings of the 2018 AlaSim international conference and exposition","author":"Cantrell WA"},{"key":"bibr8-00375497241268752","volume-title":"Kommunikation mit Automaten","author":"Petri CA","year":"1962"},{"key":"bibr9-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33278-4"},{"key":"bibr10-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1109\/5.24143"},{"key":"bibr11-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/0037549717742716"},{"key":"bibr12-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/0037549717744888"},{"key":"bibr13-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/0037549718782655"},{"key":"bibr14-00375497241268752","first-page":"1297","volume-title":"MILCOM 2011 military communications conference","author":"Dolgikh A"},{"key":"bibr15-00375497241268752","first-page":"667","volume-title":"Computer information systems and industrial management","author":"Jasiul B","year":"2015"},{"key":"bibr16-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2016.11.002"},{"key":"bibr17-00375497241268752","first-page":"4490","volume-title":"IECON 2011, 37th annual conference of the IEEE industrial electronics society","author":"Karnouskos S"},{"key":"bibr18-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2015.2406860"},{"key":"bibr19-00375497241268752","first-page":"1","volume":"3","author":"Li B","year":"2018","journal-title":"ACM Trans Cyber-Phys Syst"},{"key":"bibr20-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1109\/TAC.2016.2574120"},{"key":"bibr21-00375497241268752","first-page":"607","volume-title":"2009 IEEE conference on technologies for homeland security","author":"Henry MH"},{"key":"bibr22-00375497241268752","first-page":"2960","volume-title":"2016 IEEE international conference on systems, man, and cybernetics","author":"Fanti MP"},{"key":"bibr23-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/15485129211036937"},{"key":"bibr24-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/1548512917699725"},{"key":"bibr25-00375497241268752","first-page":"60","volume-title":"Proceedings of the 2011 IEEE symposium on computational intelligence in cyber security","author":"Zakrzewska AM"},{"key":"bibr26-00375497241268752","volume-title":"Proceedings of the 2017 AlaSim international conference and exposition","author":"Mayfield KP"},{"key":"bibr27-00375497241268752","first-page":"46","volume-title":"Proceedings of the 2018 AlaSim international conference and exposition","author":"Mayfield KP"},{"key":"bibr28-00375497241268752","first-page":"237","volume-title":"Proceedings of the 2018 international conference on security and management","author":"Mayfield KP"},{"key":"bibr29-00375497241268752","volume-title":"Discrete-event system simulation","author":"Banks J","year":"2012","edition":"5"},{"key":"bibr30-00375497241268752","volume-title":"Simulation modeling and analysis","author":"Law AM","year":"2015","edition":"5"},{"key":"bibr31-00375497241268752","unstructured":"The MITRE Corporation. Common attack pattern enumeration and classification, https:\/\/capec.mitre.org (2023, accessed 3 July 2024)."},{"key":"bibr32-00375497241268752","unstructured":"Open Web Application Security Project (OWASP). OWASP Mutillidae II, https:\/\/owasp.org\/www-project-mutillidae-ii\/ (2022, accessed 3 July 2024)."},{"key":"bibr33-00375497241268752","volume-title":"Proceedings of the 2017 AlaSim international conference and exposition","author":"Petty MD"},{"key":"bibr34-00375497241268752","first-page":"27","volume-title":"Proceedings of the 2019 international conference on modeling, simulation, and visualization methods","author":"Petty MD"},{"key":"bibr35-00375497241268752","volume-title":"Proceedings of the 2019 AlaSim conference and exhibition","author":"Petty MD"},{"key":"bibr36-00375497241268752","first-page":"67","volume-title":"Proceedings of the 2022 ACM southeast conference","author":"Petty MD"},{"key":"bibr37-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101738"},{"key":"bibr38-00375497241268752","volume-title":"Machine learning of cyberattack and defense strategies","author":"Bland JA","year":"2018"},{"key":"bibr39-00375497241268752","author":"Colvett CD","year":"2023","journal-title":"Modeling and simulation of cyberattacks to aid systems security engineers and cyber-physical designs to aid systems engineers"},{"key":"bibr40-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1002\/sys.21737"},{"key":"bibr41-00375497241268752","first-page":"67","volume-title":"Proceedings of the 2019 international conference on computational science and computational intelligence","author":"Colvett CD"},{"key":"bibr42-00375497241268752","first-page":"96","volume-title":"Proceedings of the 2023 ACM southeast conference","author":"Bearss EM"},{"key":"bibr43-00375497241268752","volume-title":"Extending machine learning of cyberattack strategies with continuous transition rates","author":"Bearss EM","year":"2023"},{"key":"bibr44-00375497241268752","author":"Whitaker TS","year":"2019","journal-title":"Generating cyberattack component models from an attack pattern database"},{"key":"bibr45-00375497241268752","unstructured":"Shipman JW. Python XML processing with lxml, http:\/\/relearn.be\/2015\/text-generation\/pylxml.pdf (2014, accessed 1 December 2023)."},{"key":"bibr46-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1145\/1530873.1530881"},{"key":"bibr47-00375497241268752","first-page":"88","volume-title":"Proceedings of the 2018 AlaSim international conference and exposition","author":"Whitaker TS"},{"key":"bibr48-00375497241268752","unstructured":"Graphviz Authors. Graphviz, www.graphviz.org\/about\/ (2023, accessed 5 December 2023)."},{"key":"bibr49-00375497241268752","volume-title":"DoD Modeling and Simulation (M&S) Verification, Validation, and Accreditation (VV&A)","author":"U.S. Department of Defense","year":"2003"},{"key":"bibr50-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1002\/9780470590621.ch10"},{"key":"bibr51-00375497241268752","first-page":"17","author":"Salmon F","year":"2009","journal-title":"Wired"},{"key":"bibr52-00375497241268752","volume-title":"Columbia accident investigation board report volume I","author":"Gehman HW","year":"2003"},{"key":"bibr53-00375497241268752","volume-title":"Verification and validation methods for extended Petri nets modeling cyberattacks","author":"Cantrell WA","year":"2021"},{"key":"bibr54-00375497241268752","volume-title":"Proceedings of the 2019 AlaSim conference and exhibition","author":"Showers PM"},{"key":"bibr55-00375497241268752","first-page":"296","volume-title":"Proceedings of the 2020 ACM southeast conference","author":"Cantrell WA"},{"key":"bibr56-00375497241268752","first-page":"123","volume-title":"Proceedings of the 2018 AlaSim international conference and exposition","author":"Cantrell WA"},{"key":"bibr57-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1002\/9780470172445.ch10"},{"key":"bibr58-00375497241268752","first-page":"1","volume":"140","author":"Likert R","year":"1932","journal-title":"Arch Psychol"},{"key":"bibr59-00375497241268752","volume-title":"Validating Petri net models of cyberattacks","author":"Christensen NM","year":"2017"},{"key":"bibr60-00375497241268752","volume-title":"Proceedings of the 2017 AlaSim international conference and exposition","author":"Bland JA"},{"key":"bibr61-00375497241268752","first-page":"67","volume-title":"Proceedings of the 2021 international conference on security and management","author":"Cantrell WA"},{"key":"bibr62-00375497241268752","unstructured":"OffSec. Kali Linux, https:\/\/www.Kali.org (2021, accessed 3 July 2024)."},{"key":"bibr63-00375497241268752","unstructured":"Parrot Security. Parrot OS, www.parrotsec.org (2021, accessed 3 July 2024)."},{"key":"bibr64-00375497241268752","unstructured":"OffSec. Damn vulnerable web application. https:\/\/github.com\/digininja\/dvwa\/ (2023, accessed 3 July 2024)."},{"key":"bibr65-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-813543-3.00004-4"},{"key":"bibr66-00375497241268752","first-page":"181","volume-title":"Proceedings of the spring 2003 simulation interoperability workshop","author":"Petty MD"},{"key":"bibr67-00375497241268752","first-page":"64","volume-title":"Proceedings of the 2019 ACM southeast conference","author":"Mayfield KP"},{"key":"bibr68-00375497241268752","first-page":"25","volume-title":"Proceedings of the 2021 ACM southeast conference","author":"Maxwell KP"},{"key":"bibr69-00375497241268752","volume-title":"Selecting and composing cyberattack component models","author":"Maxwell KP","year":"2022"},{"key":"bibr70-00375497241268752","first-page":"3","volume-title":"Proceedings of the 31st international conference on computer applications in industry and engineering","author":"Mayfield KP"},{"key":"bibr71-00375497241268752","first-page":"517","volume-title":"Proceedings of the fall 2003 simulation interoperability workshop","author":"Petty MD"},{"key":"bibr72-00375497241268752","first-page":"489","volume-title":"Proceedings of the fall 2006 simulation interoperability workshop","author":"Petty MD"},{"key":"bibr73-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1177\/0037549715590594"},{"key":"bibr74-00375497241268752","first-page":"168","volume-title":"Proceedings of the 2019 international conference on security and management","author":"Mayfield KP"},{"key":"bibr75-00375497241268752","first-page":"108","volume-title":"Proceedings of the 15th international conference on frontiers in education: computer science & computer engineering","author":"Mayfield KP"},{"key":"bibr76-00375497241268752","first-page":"589","volume-title":"Advances in parallel & distributed processing, and applications","author":"Maxwell KP","year":"2021"},{"key":"bibr77-00375497241268752","volume-title":"Reinforcement learning, an introduction","author":"Sutton RS","year":"2018","edition":"2"},{"key":"bibr78-00375497241268752","first-page":"81","volume-title":"Proceedings of the 2018 AlaSim international conference and exposition","author":"Bland JA"},{"key":"bibr79-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-31239-8_18"},{"key":"bibr80-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-19-7784-8"},{"key":"bibr81-00375497241268752","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1707.06347"},{"key":"bibr82-00375497241268752","unstructured":"OpenAI. Openai\/gym: a toolkit for developing and comparing reinforcement learning algorithms, https:\/\/github.com\/openai\/gym (2021, accessed 3 July 2024)."},{"key":"bibr83-00375497241268752","first-page":"23217","volume-title":"Proceedings of the 2023 interservice\/industry training, simulation and education conference","author":"Bearss EM"},{"key":"bibr84-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2005.10.010"},{"key":"bibr85-00375497241268752","doi-asserted-by":"publisher","DOI":"10.1093\/jigpal\/jzu038"},{"key":"bibr86-00375497241268752","first-page":"74","volume-title":"Proceedings of the 2022 ACM southeast conference","author":"Colvett CD"},{"key":"bibr87-00375497241268752","first-page":"53","volume-title":"Proceedings of the 2023 simulation innovation workshop","author":"Bearss EM"}],"container-title":["SIMULATION"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/00375497241268752","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/00375497241268752","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/00375497241268752","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T11:34:21Z","timestamp":1777635261000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.1177\/00375497241268752"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,10]]},"references-count":87,"journal-issue":{"issue":"12","published-print":{"date-parts":[[2024,12]]}},"alternative-id":["10.1177\/00375497241268752"],"URL":"https:\/\/doi.org\/10.1177\/00375497241268752","relation":{},"ISSN":["0037-5497","1741-3133"],"issn-type":[{"value":"0037-5497","type":"print"},{"value":"1741-3133","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,9,10]]}}}