Simulating Web User Behavior Using LLM-Driven Browser Automation for Realistic IDS Dataset Generation

Intrusion Detection Systems (IDS) require high-fidelity data reflecting realistic user behavior for effective training and evaluation. Traditional simulation frameworks often rely on static, rule-based models that fail to capture the variability and nuance of human activity. This thesis presents a novel approach to user behavior simulation using Large Language Models (LLMs), specifically GPT-4.1, to dynamically generate browser-based actions within a cybersecurity testbed. A command-line interface (CLI) tool was developed to translate nat-
ural language prompts into structured YAML playbooks, which are executed via a custom Playwright-based Browser Executor in the AttackMate framework. The simulation focused on a Central Alarm System (CAS) operator using ZoneMinder. A Turing-test-inspired qualitative evaluation was conducted with cybersecurity experts to assess the realism of LLM-generated behaviors compared to human-generated ones. Results indicate that LLMs can produce convincingly human-like interactions, demonstrating their potential to enhance IDS dataset generation with greater realism and lower manual effort.