标题： 阶段：被动人体活动模拟评估 显示英文标题

标题： PHASE: Passive Human Activity Simulation Evaluation

摘要： 网络安全性模拟环境，如网络训练场、蜜罐和沙箱，需要现实的人类行为才能有效，但目前尚无定量方法来评估合成用户角色的行为真实性。 本文介绍了PHASE（被动人类活动模拟评估），一个机器学习框架，它分析Zeek连接日志，并以超过90%的准确率区分人类和非人类活动。 PHASE完全被动运行，依赖标准网络监控，无需任何用户端设备或可见的监控迹象。 用于机器学习的所有网络活动均通过Zeek网络设备收集，以避免引入不必要的网络流量或可能破坏模拟环境真实性的伪影。 本文还提出了一种新的标记方法，利用本地DNS记录对网络流量进行分类，从而实现机器学习分析。 此外，我们应用SHAP（SHapley加法解释）分析来揭示表明真实人类用户的时空和行为特征。 在案例研究中，我们评估了一个合成用户角色，并识别出损害行为真实性的明显非人类模式。 基于这些见解，我们开发了一个改进的行为配置，显著提高了合成活动的人类相似性，从而产生更真实有效的合成用户角色。 显示英文摘要

摘要： Cybersecurity simulation environments, such as cyber ranges, honeypots, and sandboxes, require realistic human behavior to be effective, yet no quantitative method exists to assess the behavioral fidelity of synthetic user personas. This paper presents PHASE (Passive Human Activity Simulation Evaluation), a machine learning framework that analyzes Zeek connection logs and distinguishes human from non-human activity with over 90\% accuracy. PHASE operates entirely passively, relying on standard network monitoring without any user-side instrumentation or visible signs of surveillance. All network activity used for machine learning is collected via a Zeek network appliance to avoid introducing unnecessary network traffic or artifacts that could disrupt the fidelity of the simulation environment. The paper also proposes a novel labeling approach that utilizes local DNS records to classify network traffic, thereby enabling machine learning analysis. Furthermore, we apply SHAP (SHapley Additive exPlanations) analysis to uncover temporal and behavioral signatures indicative of genuine human users. In a case study, we evaluate a synthetic user persona and identify distinct non-human patterns that undermine behavioral realism. Based on these insights, we develop a revised behavioral configuration that significantly improves the human-likeness of synthetic activity yielding a more realistic and effective synthetic user persona.