Abstract: An automated sandbox generator for a cyber-attack exercise on a mimic network in a cloud environment can include various components. The cloud deployment component deploys the mimic network in a sandbox environment in the cloud environment. The mimic network can be a clone of components from a network that exists in an organization's environment and/or, predefined example components. The attack engine deploys a cyber threat to use an exploit for the wargaming cyber-attack exercise in the mimic network. The user interface displays, in real time, results of the wargaming cyber-attack exercise being conducted in the sandbox environment, to create a behavioral profile of how the cyber threat using the exploit would actually perform in that particular organization's environment as well as have human users interact with the cyber threat deployed by the attack engine during the cyber-attack on the mimic network, as it happens in real time, during the wargaming cyber-attack exercise.

Abstract: A virtual computing environment cloning method is used to allow rapid repeatable testing of unsupervised machine learning (ML) architectures and algorithms. A virtual reference environment contains a set of virtual devices, user accounts and IP traffic as well as scripted activity and a cyber security appliance including unsupervised ML trained on the scripted activity. A clone creator makes a replica of the environment. Clones can be taken from the reference at any time and more than one can exist simultaneously. Testing that takes place within a clone environment has no effect on the reference environment, including having no effect on the unsupervised ML architectures and algorithms. Clones can be interacted with, and outcomes from testing a clone can be recorded. Clones can be discarded after tests are completed and tests are independent and repeatable.