popescoup/malicious-agent-behavior-emulator

Malicious Agent Behavior Emulator, or MABE, is a Python tool that generates fake but realistic security log data for training and testing systems that try to detect AI driven cyberattacks. Rather than recording real attacks, it simulates a network with normal employees going about their work alongside a small number of sessions where an AI agent is exploring the network after having already broken in, and it produces detailed labeled logs of both kinds of activity. The project exists because, as of when it was written, there was no public dataset that captured how an AI conducting an attack behaves differently from a human doing the same thing. The author identifies two key differences. First, AI agents move through a network far faster than a human attacker, working at something like 47 to 158 times the speed based on published research. Second, AI agents tend to explore a network exhaustively, checking every reachable system, rather than moving with a specific target in mind the way a human attacker usually does. Every behavioral parameter used in the simulation is tied back to a cited published source, such as security research reports and academic papers, rather than being invented. Running MABE simulates a default network of 60 machines split across workstations, servers, and infrastructure systems, and generates a configurable number of normal and attack sessions. Output logs are written in formats compatible with common security tools such as Splunk and Windows event logs, and each session includes ground truth labels stating which parts of the activity were benign and which were the simulated attack, which makes the dataset useful for training or testing detection systems built around three ideas: whether an account is behaving unusually compared to its history, whether its movement pattern looks exploratory rather than purposeful, and whether its speed looks more like a machine than a person. Setup requires Python 3.11 or newer and, for one time use only, an Anthropic API key to generate a vocabulary of realistic names, every simulation run after that uses cached data and makes no further API calls. The project is released under the MIT license.