LARIAT

Not to be confused with lariat.

The Lincoln Adaptable Real-time Information Assurance Testbed (LARIAT) is a physical^[1] computing platform developed by the MIT Lincoln Laboratory as a testbed for network security applications.^[2] Use of the platform is restricted to the United States military, though some academic organizations can also use the platform under certain conditions.^[3]

Lincoln Adaptable Real-time Information Assurance Testbed

Also known as	LARIAT
Developer	MIT Lincoln Laboratory
Type	Network Security Testbed
Release date	2002 (2002)
Operating system	Modified Linux (for traffic generators)
Predecessor	Unnamed DARPA 1998/1999 testbed
Successor	LLSIM
Language	Java (for the GUI)

LARIAT was designed to help with the development and testing of intrusion detection (ID) and information assurance (IA) technologies.^[4] Initially created in 2002,^[5] LARIAT was the first simulated platform for ID testing^[6] and was created to improve upon a preexisting non-simulated testbed that was created for DARPA's 1998 and 1999 ID analyses.^[4] LARIAT is used by the United States military for training purposes and automated systems testing.^[7]

Function

The platform simulates users and reflects vulnerabilities caused by design flaws and user interactions^[8] and allows for interaction with real-world programs such as web browsers and office suites while simulating realistic user activity on these applications.^[9] These virtual users are managed by Markov models which allow them to act differently from each other in a realistic way.^[7]

This results in a realistic simulation of an active network of users that can then be targeted for malicious attacks to test the effectiveness of the attacks against network defenses, while also testing the effectiveness of intrusion detection methods and software in a simulated real-world environment with actual users in amongst the malicious traffic on the network. This is done because network intrusion detection software cannot as easily find instances of malicious network traffic when it is mixed in with non-malicious network traffic generated by legitimate users of the network.^[9]

The traffic generators used by the testbed run on a modified version of Linux,^[10] and a Java-based^[10] graphical user interface called Director^[7] is provided to allow users of the platform to configure and control testing parameters and to monitor the resulting network traffic.^[4][9]

Influence

Cyberwarfare training programs such as those at the Korea Institute of Military Science and Technology's research center use the principles and methodologies of the LARIAT platform in the development of simulated threat generators for cyberwarfare training.^[11] In non-security contexts, systems such as Artificial Intelligence programs build on the principles of the LARIAT platform to study and then simulate real-time user input and activity for automated testing systems.^[12]

LLSIM

The MIT Lincoln Laboratory designed the Lincoln Laboratory Simulator (LLSIM) as a fully virtualized Java-based successor to LARIAT that can be run on a single computer without the need for dedicated physical network hardware or expensive testbeds.^[5][13] It is not a full replacement for LARIAT, however, as it does not generate low-level data such as network packets. While this makes it more scalable than LARIAT since it simplifies certain processes, it cannot be used for certain ID testing purposes that LARIAT can be utilized for.^[14]