A Decade of GHOSTS in the Machine: From Cyber Range Realism to Cognitive Mission Rehearsal

GHOSTS began in 2017 as a practical response to a persistent cyber range problem: realistic cyber exercises require networks to be filled with traffic from users and supporting infrastructure. This provides data for exercise participants to analyze, but also provides a way for the adversary to blend in and hide its activity. Over the past decade, the project evolved from a host-based activity generator into a broader platform for simulating human, organizational, and machine behavior across cyber, social, and cognitive layers.

The central design principle of GHOSTS is sufficient realism. The system does not attempt to reproduce human behavior perfectly. Instead, it creates believable activity at the right fidelity to support training, experimentation, assessment, and mission rehearsal. This paper traces the evolution of GHOSTS as it grew from producing enclave activities (and the resultant network traffic, logs, endpoint artifacts, and browser activity) to creating non-player characters (NPCs) with preferences, relationships, knowledge, motivations, beliefs, workflows, content environments, and LLM-assisted decision making. It also describes the engineering lessons learned from sustaining GHOSTS as open source research software, including modularity, dependency management, documentation, observability, defaults, maintainability, and shared ownership.

As cyber operations increasingly intersect with broader operations in the information environment, GHOSTS now supports the larger mission of helping teams rehearse ideologically contested scenarios.