Skip to content

v9.0.0: Cyber, Social, and Cognitive Simulation

Choose a tag to compare

@sei-dupdyke sei-dupdyke released this 03 Jun 19:33
· 131 commits to master since this release
335d11e

GHOSTS Version 9 (G9) expands the platform beyond cyber simulation to include the social and cognitive domains as well.

G9 still automates realistic user behavior on systems: Browsing, email, authentication, document handling, application use, network traffic, and the artifacts expected in a populated environment, but also adds a broader model of synthetic human activity: NPCs can now hold beliefs, acquire knowledge, participate in social networks, follow workflows, and change behavior as scenarios unfold.

Highlights

Three Connected Domains

Domain Purpose
Cyber Realistic activity on hosts, networks, and applications
Social Relationships, communication pathways, trust, and influence
Cognitive Beliefs, knowledge, preferences, exposure, and state change

The social domain connects cyber activity to cognitive effects: Information can be created, distributed, encountered, interpreted, and acted upon within the same scenario.

NPCs Beyond the Endpoint

A scenario can include:

  • Blue NPCs operating hosts
  • Grey NPCs participating in synthetic environments
  • Red NPCs conducting adversarial activity
  • Ethereal NPCs modeled without dedicated endpoints

Beliefs, Knowledge, and Workflows

NPCs can now maintain evolving internal state, including:

  • Beliefs and belief updates
  • Knowledge acquisition
  • Preferences
  • Trust relationships
  • Social connections
  • Information exposure
  • Workflow progression
  • Optional LLM-assisted decision logic

This supports sufficient psychological realism for experimentation without requiring a complete model of human cognition.

Platform Direction

GHOSTS has evolved through a consistent progression:

Timelines → Preferences → NPCs → Social Relationships → Beliefs → Knowledge → Workflows → Multi-Domain Scenarios

G9 formalizes that shift.

GHOSTS is now a realism and actuation layer for cyber, social, and cognitive simulation. It can operate independently or as part of a broader training, experimentation, or mission-rehearsal stack.

Upgrade Notes

G9 introduces substantial architectural changes.

Before upgrading:

  1. Back up the database.
  2. Review and apply migrations.
  3. Validate existing timelines, handlers, and NPC configurations.
  4. Test current scenarios in a non-production environment.
  5. Review integrations that depend on earlier API behavior.

Existing cyber-range use cases remain supported. Social and cognitive capabilities can be adopted incrementally.