Abstract: Systems for generating attack event logs are disclosed. An example system includes a storage device for storing an event log template. The system also includes a processor to receive a selection of the event log template, and receive an attack description comprising user instructions to fabricate synthetic log entries according to a format defined in the event log template. The attack description includes variables and rules for determining values for the variables. The processor generates the attack event log by determining values that satisfy the rules and writing the values into selected fields of the event log template.

Abstract: An example system includes a processor to receive a data set for training a machine learning model. The processor can train the machine learning model on the data set. The processor can also translate the machine learning model into constraint satisfaction problem (CSP) variables and constraints. The processor can generate fabricated data based on the CSP variables and constraints.

Abstract: A computer-implemented method comprising, automatically: analyzing a machine learning dataset which comprises multiple datapoints, to deduce constraints on features of the datapoints; generating a first set of CSP (Constraint Satisfaction Problem) rules expressing the constraints; based on a machine learning model which was trained on the dataset, generating a second set of CSP rules that define one or more perturbation candidates among the features of one of the datapoints; formulating a CSP based on the first and second sets of CSP rules; solving the formulated CSP using a solver; and using the solution of the CSP as a counterfactual explanation of a prediction made by the machine learning model with respect to the one datapoint.

Abstract: Systems for generating attack event logs are disclosed. An example system includes a storage device for storing an event log template. The system also includes a processor to receive a selection of the event log template, and receive an attack description comprising user instructions to fabricate synthetic log entries according to a format defined in the event log template. The attack description includes variables and rules for determining values for the variables. The processor generates the attack event log by determining values that satisfy the rules and writing the values into selected fields of the event log template.

Abstract: Methods, computing systems and computer program products implement embodiments of the present invention that include receiving a request to fabricate, for a database including multiple tables, a respective target number of data records for each of the tables, and receiving one or more intra-database rules for the multiple tables. Examples of the intra-database rules include cross-record rules and cross-table rules. Upon identifying one or more referential integrity constraints for the multiple tables, the respective target number of data records for each of the multiple tables are fabricated in response to the request. In embodiments of the present invention, the fabricated data records comply with the one or more referential integrity constraints and the one or more intra-database rules.

Abstract: Embodiments are directed to a computer implemented method for fabricating test data. The method includes receiving, using a processor system, a file format layout having variables. The method further includes receiving, using the processor system, rules that are defined independently of the file format layout, wherein the rules impose constraints on the variables. The method further includes defining a constraint problem based on the variables and the constraints, and solving the constraint problem.

Abstract: Methods, computing systems and computer program products implement embodiments of the present invention that include defining multiple data fabrication rules, each of the data fabrication rules including a fabrication time and a data operation. a simulation of a software application is initiated, the simulation including a sequence of simulation times, and upon detecting, during the simulation, one or more first given fabrication rules having respective fabrication times matching one or more first simulation times, fabricated data is generated in response to performing the respective data operation of each of the detected one or more first given fabrication rules. Upon detecting, during the simulation, a second given fabrication rule whose fabrication time matches a second simulation time subsequent to the one or more first simulation times, the data operation of the second given fabrication rule is performed on a subset of the fabricated data.

Abstract: Methods, computing systems and computer program products implement embodiments of the present invention that include receiving a request to fabricate, for a database including multiple tables, a respective target number of data records for each of the tables, and receiving one or more intra-database rules for the multiple tables. Examples of the intra-database rules include cross-record rules and cross-table rules. Upon identifying one or more referential integrity constraints for the multiple tables, the respective target number of data records for each of the multiple tables are fabricated in response to the request. In embodiments of the present invention, the fabricated data records comply with the one or more referential integrity constraints and the one or more intra-database rules.

Abstract: Methods, computing systems and computer program products implement embodiments of the present invention that include defining multiple data fabrication rules, each of the data fabrication rules including a fabrication time and a data operation. a simulation of a software application is initiated, the simulation including a sequence of simulation times, and upon detecting, during the simulation, one or more first given fabrication rules having respective fabrication times matching one or more first simulation times, fabricated data is generated in response to performing the respective data operation of each of the detected one or more first given fabrication rules. Upon detecting, during the simulation, a second given fabrication rule whose fabrication time matches a second simulation time subsequent to the one or more first simulation times, the data operation of the second given fabrication rule is performed on a subset of the fabricated data.

Abstract: A method for fabricating test data, comprising using a hardware processor for: receiving a plurality of data sources; receiving a plurality of targets to be populated with the test data; obtaining a plurality of data fabrication rules; receiving a fabrication use-case having a hierarchic structure and comprising one or more tasks each associated with one or more data fabrication rules and with a set of targets; formulating at least some of the data fabrication rules as corresponding constraints; and performing the following steps for each task according to the hierarchic structure of the fabrication use-case: applying, to data sources the constraints corresponding to at least some data fabrication rules associated with said each task to receive a solution, and (b) populating the associated set of targets with the solution, to receive fabricated test data.